{"action":"created","issue":{"url":"https://api.github.com/repos/hapijs/crumb/issues/61","labels_url":"https://api.github.com/repos/hapijs/crumb/issues/61/labels{/name}","comments_url":"https://api.github.com/repos/hapijs/crumb/issues/61/comments","events_url":"https://api.github.com/repos/hapijs/crumb/issues/61/events","html_url":"https://github.com/hapijs/crumb/issues/61","id":111899625,"number":61,"title":"Ignore CORS","user":{"login":"hueniverse","id":56631,"avatar_url":"https://avatars.githubusercontent.com/u/56631?v=3","gravatar_id":"","url":"https://api.github.com/users/hueniverse","html_url":"https://github.com/hueniverse","followers_url":"https://api.github.com/users/hueniverse/followers","following_url":"https://api.github.com/users/hueniverse/following{/other_user}","gists_url":"https://api.github.com/users/hueniverse/gists{/gist_id}","starred_url":"https://api.github.com/users/hueniverse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hueniverse/subscriptions","organizations_url":"https://api.github.com/users/hueniverse/orgs","repos_url":"https://api.github.com/users/hueniverse/repos","events_url":"https://api.github.com/users/hueniverse/events{/privacy}","received_events_url":"https://api.github.com/users/hueniverse/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hapijs/crumb/labels/breaking%20changes","name":"breaking changes","color":"eb6420"},{"url":"https://api.github.com/repos/hapijs/crumb/labels/security","name":"security","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-10-16T19:53:09Z","updated_at":"2016-01-12T14:51:00Z","closed_at":null,"body":"I don't know why the change was made to skip crumb protection when CORS is enabled but please revert that change. While theoretically, a properly configured CORS deployment does not need much of this extra protection, this is a violation of security layering principle.\r\n\r\nAlso, almost no one configures CORS correctly."},"comment":{"url":"https://api.github.com/repos/hapijs/crumb/issues/comments/170937036","html_url":"https://github.com/hapijs/crumb/issues/61#issuecomment-170937036","issue_url":"https://api.github.com/repos/hapijs/crumb/issues/61","id":170937036,"user":{"login":"stongo","id":1449748,"avatar_url":"https://avatars.githubusercontent.com/u/1449748?v=3","gravatar_id":"","url":"https://api.github.com/users/stongo","html_url":"https://github.com/stongo","followers_url":"https://api.github.com/users/stongo/followers","following_url":"https://api.github.com/users/stongo/following{/other_user}","gists_url":"https://api.github.com/users/stongo/gists{/gist_id}","starred_url":"https://api.github.com/users/stongo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stongo/subscriptions","organizations_url":"https://api.github.com/users/stongo/orgs","repos_url":"https://api.github.com/users/stongo/repos","events_url":"https://api.github.com/users/stongo/events{/privacy}","received_events_url":"https://api.github.com/users/stongo/received_events","type":"User","site_admin":false},"created_at":"2016-01-12T14:51:00Z","updated_at":"2016-01-12T14:51:00Z","body":"Using `request.info.cors.isOriginMatch` alone won't allow a route to set the crumb for a CORS client and same-origin client (ie server rendered page)\r\nThat was what the extra logic had been for. Set crumb if it's a same-origin request OR an allowed CORS origin.\r\nMaybe we don't support that, but it had been a request that came in an issue."}}