mirrors/remark42
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bump go-pkgz/rest to v1.24.0 and opt in to wildcard origins with credentials (#2157)

Browse Source 
rest.CORS refuses "*" together with credentials since go-pkgz/rest#52, so the
bump and the option have to land together: the option does not exist in v1.22.0
and the panic fires at construction, inside routes(), which makes it a startup
failure rather than a request-time one.

The wildcard stays. The comment widget is embedded on arbitrary third-party
sites, so the set of origins is not knowable, which is why the escape hatch was
asked for upstream instead of accepting the panic. What it costs is unchanged
and now written next to the call: any site a signed-in user visits can read
authenticated responses, so state-changing requests have to keep being protected
by something other than the origin, X-XSRF-Token today.

The example module is tidied in the same commit, as it reaches go-pkgz/rest
through the replace directive and its indirect graph would otherwise keep the
old pin and fail the readonly module check in CI.

The bump also carries testify to v1.12.0, which drops go-spew and go-difflib
from the module graph.
This commit is contained in:
Dmitry Verkhoturov
2026-08-19 00:33:13 -05:00
committed by GitHub
parent 455d770899
commit 1f34984dab
43 changed files with 926 additions and 652 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/backlog/cors-wildcard-credentials-optin.md
-33
View File
@@ -1,33 +0,0 @@
---
worth: yes
where: backend/app/rest/api/middleware.go:127
added: 2026-08-18
---
# corsMiddleware panics at boot once go-pkgz/rest is bumped past v1.22.0
`corsMiddleware` passes `R.CorsAllowedOrigins("*")` together with `R.CorsAllowCredentials(true)`
(lines 128 and 132). go-pkgz/rest#52 makes `rest.CORS` panic at construction on exactly that
combination, so the next bump of `github.com/go-pkgz/rest` past the pinned `v1.22.0`
(`backend/go.mod:16`) crashes remark42 on startup, not at request time.
The fix is one option:
```go
R.CorsAllowedOrigins("*"),
R.CorsAllowCredentials(true),
R.CorsUnsafeAnyOriginWithCredentials(true),
```
It cannot be added before the bump, since the option does not exist in v1.22.0. So this is bump and
edit in one commit, in either order within that commit, and it will not compile split across two.
Why the wildcard stays rather than the origins being enumerated: remark42 serves a comment widget
embedded on arbitrary third-party sites, so the set of origins is not knowable. The upstream default
is right for a normal service and wrong here, which is why the escape hatch was asked for instead of
accepting the panic. The named consequence stands and is worth re-reading when this is touched: any
site a signed-in user visits can read authenticated responses, so state-changing requests must keep
being protected by something other than the origin (`X-XSRF-Token` today).
Surfaced reviewing go-pkgz/rest#52. The unconditional panic in the original version of that PR was
pushed back on precisely because remark42 had no way to comply; `CorsUnsafeAnyOriginWithCredentials`
exists as a result.