{"action":"closed","number":20281,"pull_request":{"url":"https://api.github.com/repos/guardian/frontend/pulls/20281","id":213247061,"node_id":"MDExOlB1bGxSZXF1ZXN0MjEzMjQ3MDYx","html_url":"https://github.com/guardian/frontend/pull/20281","diff_url":"https://github.com/guardian/frontend/pull/20281.diff","patch_url":"https://github.com/guardian/frontend/pull/20281.patch","issue_url":"https://api.github.com/repos/guardian/frontend/issues/20281","number":20281,"state":"closed","locked":false,"title":"Disallow CORS on unsupported origins","user":{"login":"nicl","id":858402,"node_id":"MDQ6VXNlcjg1ODQwMg==","avatar_url":"https://avatars2.githubusercontent.com/u/858402?v=4","gravatar_id":"","url":"https://api.github.com/users/nicl","html_url":"https://github.com/nicl","followers_url":"https://api.github.com/users/nicl/followers","following_url":"https://api.github.com/users/nicl/following{/other_user}","gists_url":"https://api.github.com/users/nicl/gists{/gist_id}","starred_url":"https://api.github.com/users/nicl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nicl/subscriptions","organizations_url":"https://api.github.com/users/nicl/orgs","repos_url":"https://api.github.com/users/nicl/repos","events_url":"https://api.github.com/users/nicl/events{/privacy}","received_events_url":"https://api.github.com/users/nicl/received_events","type":"User","site_admin":false},"body":"It's unclear why this was supported before, but allowing CORS on all origins doesn't seem like a sensible default.\r\n\r\nCalling code can still provide a fallback origin to support if needed.\r\n\r\nIt is hard to know up front if this will break things. We have a whitelist of origins in our config with a list of seemingly sensible values, but it's possible there are other origins we need to add too. However, our Kibana logs for Frontend show that in the last 24 hours 100% of requests with an origin value were for `https://www.theguardian.com`, which suggests things should be okay.\r\n\r\n## What does this change?\r\n\r\nRemove CORS support for non-whitelisted origins.\r\n\r\n## What is the value of this and can you measure success?\r\n\r\nReduces future risk of a cors security issue.\r\n\r\n\r\n","created_at":"2018-09-05T10:39:40Z","updated_at":"2018-09-05T13:17:00Z","closed_at":"2018-09-05T13:17:00Z","merged_at":"2018-09-05T13:16:59Z","merge_commit_sha":"cedfa6ee2686cf16d6b4541b0f618e9f9f71a5ca","assignee":null,"assignees":[],"requested_reviewers":[{"login":"adamnfish","id":29761,"node_id":"MDQ6VXNlcjI5NzYx","avatar_url":"https://avatars0.githubusercontent.com/u/29761?v=4","gravatar_id":"","url":"https://api.github.com/users/adamnfish","html_url":"https://github.com/adamnfish","followers_url":"https://api.github.com/users/adamnfish/followers","following_url":"https://api.github.com/users/adamnfish/following{/other_user}","gists_url":"https://api.github.com/users/adamnfish/gists{/gist_id}","starred_url":"https://api.github.com/users/adamnfish/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adamnfish/subscriptions","organizations_url":"https://api.github.com/users/adamnfish/orgs","repos_url":"https://api.github.com/users/adamnfish/repos","events_url":"https://api.github.com/users/adamnfish/events{/privacy}","received_events_url":"https://api.github.com/users/adamnfish/received_events","type":"User","site_admin":false},{"login":"MatthewJWalls","id":1218561,"node_id":"MDQ6VXNlcjEyMTg1NjE=","avatar_url":"https://avatars2.githubusercontent.com/u/1218561?v=4","gravatar_id":"","url":"https://api.github.com/users/MatthewJWalls","html_url":"https://github.com/MatthewJWalls","followers_url":"https://api.github.com/users/MatthewJWalls/followers","following_url":"https://api.github.com/users/MatthewJWalls/following{/other_user}","gists_url":"https://api.github.com/users/MatthewJWalls/gists{/gist_id}","starred_url":"https://api.github.com/users/MatthewJWalls/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MatthewJWalls/subscriptions","organizations_url":"https://api.github.com/users/MatthewJWalls/orgs","repos_url":"https://api.github.com/users/MatthewJWalls/repos","events_url":"https://api.github.com/users/MatthewJWalls/events{/privacy}","received_events_url":"https://api.github.com/users/MatthewJWalls/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/guardian/frontend/pulls/20281/commits","review_comments_url":"https://api.github.com/repos/guardian/frontend/pulls/20281/comments","review_comment_url":"https://api.github.com/repos/guardian/frontend/pulls/comments{/number}","comments_url":"https://api.github.com/repos/guardian/frontend/issues/20281/comments","statuses_url":"https://api.github.com/repos/guardian/frontend/statuses/332900ea94e0063c6afb32ca8cf11f71f530321c","head":{"label":"guardian:nicl/cors-issue","ref":"nicl/cors-issue","sha":"332900ea94e0063c6afb32ca8cf11f71f530321c","user":{"login":"guardian","id":164318,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE2NDMxOA==","avatar_url":"https://avatars0.githubusercontent.com/u/164318?v=4","gravatar_id":"","url":"https://api.github.com/users/guardian","html_url":"https://github.com/guardian","followers_url":"https://api.github.com/users/guardian/followers","following_url":"https://api.github.com/users/guardian/following{/other_user}","gists_url":"https://api.github.com/users/guardian/gists{/gist_id}","starred_url":"https://api.github.com/users/guardian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guardian/subscriptions","organizations_url":"https://api.github.com/users/guardian/orgs","repos_url":"https://api.github.com/users/guardian/repos","events_url":"https://api.github.com/users/guardian/events{/privacy}","received_events_url":"https://api.github.com/users/guardian/received_events","type":"Organization","site_admin":false},"repo":{"id":4370755,"node_id":"MDEwOlJlcG9zaXRvcnk0MzcwNzU1","name":"frontend","full_name":"guardian/frontend","owner":{"login":"guardian","id":164318,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE2NDMxOA==","avatar_url":"https://avatars0.githubusercontent.com/u/164318?v=4","gravatar_id":"","url":"https://api.github.com/users/guardian","html_url":"https://github.com/guardian","followers_url":"https://api.github.com/users/guardian/followers","following_url":"https://api.github.com/users/guardian/following{/other_user}","gists_url":"https://api.github.com/users/guardian/gists{/gist_id}","starred_url":"https://api.github.com/users/guardian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guardian/subscriptions","organizations_url":"https://api.github.com/users/guardian/orgs","repos_url":"https://api.github.com/users/guardian/repos","events_url":"https://api.github.com/users/guardian/events{/privacy}","received_events_url":"https://api.github.com/users/guardian/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/guardian/frontend","description":"Source for theguardian.com","fork":false,"url":"https://api.github.com/repos/guardian/frontend","forks_url":"https://api.github.com/repos/guardian/frontend/forks","keys_url":"https://api.github.com/repos/guardian/frontend/keys{/key_id}","collaborators_url":"https://api.github.com/repos/guardian/frontend/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/guardian/frontend/teams","hooks_url":"https://api.github.com/repos/guardian/frontend/hooks","issue_events_url":"https://api.github.com/repos/guardian/frontend/issues/events{/number}","events_url":"https://api.github.com/repos/guardian/frontend/events","assignees_url":"https://api.github.com/repos/guardian/frontend/assignees{/user}","branches_url":"https://api.github.com/repos/guardian/frontend/branches{/branch}","tags_url":"https://api.github.com/repos/guardian/frontend/tags","blobs_url":"https://api.github.com/repos/guardian/frontend/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/guardian/frontend/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/guardian/frontend/git/refs{/sha}","trees_url":"https://api.github.com/repos/guardian/frontend/git/trees{/sha}","statuses_url":"https://api.github.com/repos/guardian/frontend/statuses/{sha}","languages_url":"https://api.github.com/repos/guardian/frontend/languages","stargazers_url":"https://api.github.com/repos/guardian/frontend/stargazers","contributors_url":"https://api.github.com/repos/guardian/frontend/contributors","subscribers_url":"https://api.github.com/repos/guardian/frontend/subscribers","subscription_url":"https://api.github.com/repos/guardian/frontend/subscription","commits_url":"https://api.github.com/repos/guardian/frontend/commits{/sha}","git_commits_url":"https://api.github.com/repos/guardian/frontend/git/commits{/sha}","comments_url":"https://api.github.com/repos/guardian/frontend/comments{/number}","issue_comment_url":"https://api.github.com/repos/guardian/frontend/issues/comments{/number}","contents_url":"https://api.github.com/repos/guardian/frontend/contents/{+path}","compare_url":"https://api.github.com/repos/guardian/frontend/compare/{base}...{head}","merges_url":"https://api.github.com/repos/guardian/frontend/merges","archive_url":"https://api.github.com/repos/guardian/frontend/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/guardian/frontend/downloads","issues_url":"https://api.github.com/repos/guardian/frontend/issues{/number}","pulls_url":"https://api.github.com/repos/guardian/frontend/pulls{/number}","milestones_url":"https://api.github.com/repos/guardian/frontend/milestones{/number}","notifications_url":"https://api.github.com/repos/guardian/frontend/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/guardian/frontend/labels{/name}","releases_url":"https://api.github.com/repos/guardian/frontend/releases{/id}","deployments_url":"https://api.github.com/repos/guardian/frontend/deployments","created_at":"2012-05-18T15:39:15Z","updated_at":"2018-09-05T13:04:50Z","pushed_at":"2018-09-05T13:16:59Z","git_url":"git://github.com/guardian/frontend.git","ssh_url":"git@github.com:guardian/frontend.git","clone_url":"https://github.com/guardian/frontend.git","svn_url":"https://github.com/guardian/frontend","homepage":"https://www.theguardian.com","size":603278,"stargazers_count":4896,"watchers_count":4896,"language":"HTML","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":504,"mirror_url":null,"archived":false,"open_issues_count":43,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":504,"open_issues":43,"watchers":4896,"default_branch":"master"}},"base":{"label":"guardian:master","ref":"master","sha":"a95c20674fd01c6210c83ed7ede05f58a398c722","user":{"login":"guardian","id":164318,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE2NDMxOA==","avatar_url":"https://avatars0.githubusercontent.com/u/164318?v=4","gravatar_id":"","url":"https://api.github.com/users/guardian","html_url":"https://github.com/guardian","followers_url":"https://api.github.com/users/guardian/followers","following_url":"https://api.github.com/users/guardian/following{/other_user}","gists_url":"https://api.github.com/users/guardian/gists{/gist_id}","starred_url":"https://api.github.com/users/guardian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guardian/subscriptions","organizations_url":"https://api.github.com/users/guardian/orgs","repos_url":"https://api.github.com/users/guardian/repos","events_url":"https://api.github.com/users/guardian/events{/privacy}","received_events_url":"https://api.github.com/users/guardian/received_events","type":"Organization","site_admin":false},"repo":{"id":4370755,"node_id":"MDEwOlJlcG9zaXRvcnk0MzcwNzU1","name":"frontend","full_name":"guardian/frontend","owner":{"login":"guardian","id":164318,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE2NDMxOA==","avatar_url":"https://avatars0.githubusercontent.com/u/164318?v=4","gravatar_id":"","url":"https://api.github.com/users/guardian","html_url":"https://github.com/guardian","followers_url":"https://api.github.com/users/guardian/followers","following_url":"https://api.github.com/users/guardian/following{/other_user}","gists_url":"https://api.github.com/users/guardian/gists{/gist_id}","starred_url":"https://api.github.com/users/guardian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guardian/subscriptions","organizations_url":"https://api.github.com/users/guardian/orgs","repos_url":"https://api.github.com/users/guardian/repos","events_url":"https://api.github.com/users/guardian/events{/privacy}","received_events_url":"https://api.github.com/users/guardian/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/guardian/frontend","description":"Source for theguardian.com","fork":false,"url":"https://api.github.com/repos/guardian/frontend","forks_url":"https://api.github.com/repos/guardian/frontend/forks","keys_url":"https://api.github.com/repos/guardian/frontend/keys{/key_id}","collaborators_url":"https://api.github.com/repos/guardian/frontend/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/guardian/frontend/teams","hooks_url":"https://api.github.com/repos/guardian/frontend/hooks","issue_events_url":"https://api.github.com/repos/guardian/frontend/issues/events{/number}","events_url":"https://api.github.com/repos/guardian/frontend/events","assignees_url":"https://api.github.com/repos/guardian/frontend/assignees{/user}","branches_url":"https://api.github.com/repos/guardian/frontend/branches{/branch}","tags_url":"https://api.github.com/repos/guardian/frontend/tags","blobs_url":"https://api.github.com/repos/guardian/frontend/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/guardian/frontend/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/guardian/frontend/git/refs{/sha}","trees_url":"https://api.github.com/repos/guardian/frontend/git/trees{/sha}","statuses_url":"https://api.github.com/repos/guardian/frontend/statuses/{sha}","languages_url":"https://api.github.com/repos/guardian/frontend/languages","stargazers_url":"https://api.github.com/repos/guardian/frontend/stargazers","contributors_url":"https://api.github.com/repos/guardian/frontend/contributors","subscribers_url":"https://api.github.com/repos/guardian/frontend/subscribers","subscription_url":"https://api.github.com/repos/guardian/frontend/subscription","commits_url":"https://api.github.com/repos/guardian/frontend/commits{/sha}","git_commits_url":"https://api.github.com/repos/guardian/frontend/git/commits{/sha}","comments_url":"https://api.github.com/repos/guardian/frontend/comments{/number}","issue_comment_url":"https://api.github.com/repos/guardian/frontend/issues/comments{/number}","contents_url":"https://api.github.com/repos/guardian/frontend/contents/{+path}","compare_url":"https://api.github.com/repos/guardian/frontend/compare/{base}...{head}","merges_url":"https://api.github.com/repos/guardian/frontend/merges","archive_url":"https://api.github.com/repos/guardian/frontend/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/guardian/frontend/downloads","issues_url":"https://api.github.com/repos/guardian/frontend/issues{/number}","pulls_url":"https://api.github.com/repos/guardian/frontend/pulls{/number}","milestones_url":"https://api.github.com/repos/guardian/frontend/milestones{/number}","notifications_url":"https://api.github.com/repos/guardian/frontend/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/guardian/frontend/labels{/name}","releases_url":"https://api.github.com/repos/guardian/frontend/releases{/id}","deployments_url":"https://api.github.com/repos/guardian/frontend/deployments","created_at":"2012-05-18T15:39:15Z","updated_at":"2018-09-05T13:04:50Z","pushed_at":"2018-09-05T13:16:59Z","git_url":"git://github.com/guardian/frontend.git","ssh_url":"git@github.com:guardian/frontend.git","clone_url":"https://github.com/guardian/frontend.git","svn_url":"https://github.com/guardian/frontend","homepage":"https://www.theguardian.com","size":603278,"stargazers_count":4896,"watchers_count":4896,"language":"HTML","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":504,"mirror_url":null,"archived":false,"open_issues_count":43,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":504,"open_issues":43,"watchers":4896,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/guardian/frontend/pulls/20281"},"html":{"href":"https://github.com/guardian/frontend/pull/20281"},"issue":{"href":"https://api.github.com/repos/guardian/frontend/issues/20281"},"comments":{"href":"https://api.github.com/repos/guardian/frontend/issues/20281/comments"},"review_comments":{"href":"https://api.github.com/repos/guardian/frontend/pulls/20281/comments"},"review_comment":{"href":"https://api.github.com/repos/guardian/frontend/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/guardian/frontend/pulls/20281/commits"},"statuses":{"href":"https://api.github.com/repos/guardian/frontend/statuses/332900ea94e0063c6afb32ca8cf11f71f530321c"}},"author_association":"CONTRIBUTOR","merged":true,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":{"login":"nicl","id":858402,"node_id":"MDQ6VXNlcjg1ODQwMg==","avatar_url":"https://avatars2.githubusercontent.com/u/858402?v=4","gravatar_id":"","url":"https://api.github.com/users/nicl","html_url":"https://github.com/nicl","followers_url":"https://api.github.com/users/nicl/followers","following_url":"https://api.github.com/users/nicl/following{/other_user}","gists_url":"https://api.github.com/users/nicl/gists{/gist_id}","starred_url":"https://api.github.com/users/nicl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nicl/subscriptions","organizations_url":"https://api.github.com/users/nicl/orgs","repos_url":"https://api.github.com/users/nicl/repos","events_url":"https://api.github.com/users/nicl/events{/privacy}","received_events_url":"https://api.github.com/users/nicl/received_events","type":"User","site_admin":false},"comments":1,"review_comments":3,"maintainer_can_modify":false,"commits":2,"additions":18,"deletions":14,"changed_files":3}}
{"actor":{"display_login":"nicl"}}