{"action":"created","issue":{"url":"https://api.github.com/repos/syncthing/syncthing/issues/3541","repository_url":"https://api.github.com/repos/syncthing/syncthing","labels_url":"https://api.github.com/repos/syncthing/syncthing/issues/3541/labels{/name}","comments_url":"https://api.github.com/repos/syncthing/syncthing/issues/3541/comments","events_url":"https://api.github.com/repos/syncthing/syncthing/issues/3541/events","html_url":"https://github.com/syncthing/syncthing/pull/3541","id":172829305,"number":3541,"title":"cmd/syncthing: Re-enable \"Access-Control-Allow-Origin\" header","user":{"login":"letiemble","id":127328,"avatar_url":"https://avatars.githubusercontent.com/u/127328?v=3","gravatar_id":"","url":"https://api.github.com/users/letiemble","html_url":"https://github.com/letiemble","followers_url":"https://api.github.com/users/letiemble/followers","following_url":"https://api.github.com/users/letiemble/following{/other_user}","gists_url":"https://api.github.com/users/letiemble/gists{/gist_id}","starred_url":"https://api.github.com/users/letiemble/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/letiemble/subscriptions","organizations_url":"https://api.github.com/users/letiemble/orgs","repos_url":"https://api.github.com/users/letiemble/repos","events_url":"https://api.github.com/users/letiemble/events{/privacy}","received_events_url":"https://api.github.com/users/letiemble/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-08-23T23:13:57Z","updated_at":"2016-08-24T18:54:36Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/syncthing/syncthing/pulls/3541","html_url":"https://github.com/syncthing/syncthing/pull/3541","diff_url":"https://github.com/syncthing/syncthing/pull/3541.diff","patch_url":"https://github.com/syncthing/syncthing/pull/3541.patch"},"body":"### Purpose\r\n\r\nThis PR re-enables the \"Access-Control-Allow-Origin\" header so clients like browsers can perform CORS requests. This fixes issue #3540.\r\n\r\n### Testing\r\n\r\nNew tests have been included.\r\n"},"comment":{"url":"https://api.github.com/repos/syncthing/syncthing/issues/comments/242171428","html_url":"https://github.com/syncthing/syncthing/pull/3541#issuecomment-242171428","issue_url":"https://api.github.com/repos/syncthing/syncthing/issues/3541","id":242171428,"user":{"login":"calmh","id":125426,"avatar_url":"https://avatars.githubusercontent.com/u/125426?v=3","gravatar_id":"","url":"https://api.github.com/users/calmh","html_url":"https://github.com/calmh","followers_url":"https://api.github.com/users/calmh/followers","following_url":"https://api.github.com/users/calmh/following{/other_user}","gists_url":"https://api.github.com/users/calmh/gists{/gist_id}","starred_url":"https://api.github.com/users/calmh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calmh/subscriptions","organizations_url":"https://api.github.com/users/calmh/orgs","repos_url":"https://api.github.com/users/calmh/repos","events_url":"https://api.github.com/users/calmh/events{/privacy}","received_events_url":"https://api.github.com/users/calmh/received_events","type":"User","site_admin":false},"created_at":"2016-08-24T18:54:36Z","updated_at":"2016-08-24T18:54:36Z","body":"> - support pre-flight OPTIONS requests because of the X-API-KEY header\r\n> - provide a \"Access-Control-Allow-Origin\" header because the domain of the application is different from the domains of the Synching instances\r\n\r\nWould it be possible/viable to only set the A-C-A-O header when a valid X-API-Key is received? Or will the browser not add that to the OPTIONS request? For your use case, which is entirely valid IMO, we can always require an API key. For the \"regular\" GUI CSRF-token stuff I don't see a need to permit foreign origins.\r\n\r\n> Finally, I think the /rest/system/config endpoint should strip the user/password/apiKey information on GET (or any sensible information), while accepting them on POST.\r\n\r\nYes. Well, the user isn't that sensitive and the password is bcrypt hashed, but the API key should not be visible in the config get. It just requires a rewiring of the GUI for that to happen."}}
{"actor":{"display_login":"calmh"}}