{"action":"created","issue":{"url":"https://api.github.com/repos/symfony/symfony/issues/18413","repository_url":"https://api.github.com/repos/symfony/symfony","labels_url":"https://api.github.com/repos/symfony/symfony/issues/18413/labels{/name}","comments_url":"https://api.github.com/repos/symfony/symfony/issues/18413/comments","events_url":"https://api.github.com/repos/symfony/symfony/issues/18413/events","html_url":"https://github.com/symfony/symfony/pull/18413","id":145361200,"number":18413,"title":"[2.7][WebProfilerBundle] Fix CORS ajax security issues","user":{"login":"romainneutron","id":137574,"avatar_url":"https://avatars.githubusercontent.com/u/137574?v=3","gravatar_id":"","url":"https://api.github.com/users/romainneutron","html_url":"https://github.com/romainneutron","followers_url":"https://api.github.com/users/romainneutron/followers","following_url":"https://api.github.com/users/romainneutron/following{/other_user}","gists_url":"https://api.github.com/users/romainneutron/gists{/gist_id}","starred_url":"https://api.github.com/users/romainneutron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/romainneutron/subscriptions","organizations_url":"https://api.github.com/users/romainneutron/orgs","repos_url":"https://api.github.com/users/romainneutron/repos","events_url":"https://api.github.com/users/romainneutron/events{/privacy}","received_events_url":"https://api.github.com/users/romainneutron/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/symfony/symfony/labels/Bug","name":"Bug","color":"e10c02"},{"url":"https://api.github.com/repos/symfony/symfony/labels/Status:%20Needs%20Review","name":"Status: Needs Review","color":"ededed"},{"url":"https://api.github.com/repos/symfony/symfony/labels/WebProfilerBundle","name":"WebProfilerBundle","color":"DDDDDD"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-04-02T10:41:27Z","updated_at":"2016-04-06T11:58:50Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/symfony/symfony/pulls/18413","html_url":"https://github.com/symfony/symfony/pull/18413","diff_url":"https://github.com/symfony/symfony/pull/18413.diff","patch_url":"https://github.com/symfony/symfony/pull/18413.patch"},"body":"| Q             | A\r\n| ------------- | ---\r\n| Branch?       | 2.7\r\n| Bug fix?      | yes\r\n| New feature?  | no\r\n| BC breaks?    | no\r\n| Deprecations? | no\r\n| Tests pass?   | yes\r\n| Fixed tickets | N/A\r\n| License       | MIT\r\n| Doc PR        | N/A\r\n\r\nThe WebProfiler toolbar monitors ajax requests. However, when using cross domain ajax requests, it triggers a security issues `Refused to get unsafe header \"X-Debug-Token\"` `Refused to get unsafe header \"X-Debug-Token-Link\"` because if the other app is not a Symfony App configured to expose these headers in CORS.\r\n\r\n![image](https://cloud.githubusercontent.com/assets/137574/14225799/f462c09c-f8cf-11e5-925d-88be99945a92.png)\r\n\r\nThis fixes the issue. It adds a new configuration node to explicitly activate it on purpose."},"comment":{"url":"https://api.github.com/repos/symfony/symfony/issues/comments/206337352","html_url":"https://github.com/symfony/symfony/pull/18413#issuecomment-206337352","issue_url":"https://api.github.com/repos/symfony/symfony/issues/18413","id":206337352,"user":{"login":"kroshp","id":2798302,"avatar_url":"https://avatars.githubusercontent.com/u/2798302?v=3","gravatar_id":"","url":"https://api.github.com/users/kroshp","html_url":"https://github.com/kroshp","followers_url":"https://api.github.com/users/kroshp/followers","following_url":"https://api.github.com/users/kroshp/following{/other_user}","gists_url":"https://api.github.com/users/kroshp/gists{/gist_id}","starred_url":"https://api.github.com/users/kroshp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kroshp/subscriptions","organizations_url":"https://api.github.com/users/kroshp/orgs","repos_url":"https://api.github.com/users/kroshp/repos","events_url":"https://api.github.com/users/kroshp/events{/privacy}","received_events_url":"https://api.github.com/users/kroshp/received_events","type":"User","site_admin":false},"created_at":"2016-04-06T11:58:49Z","updated_at":"2016-04-06T11:58:49Z","body":"Same issue in 2.8"}}