From a725d990edfcadf02dd0bbbaf26f733178bb6114 Mon Sep 17 00:00:00 2001 From: Umputun Date: Tue, 18 Aug 2026 18:58:07 -0500 Subject: [PATCH] docs: add backlog item for the CORS wildcard credentials opt-in --- .../cors-wildcard-credentials-optin.md | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 docs/backlog/cors-wildcard-credentials-optin.md diff --git a/docs/backlog/cors-wildcard-credentials-optin.md b/docs/backlog/cors-wildcard-credentials-optin.md new file mode 100644 index 00000000..226e46b2 --- /dev/null +++ b/docs/backlog/cors-wildcard-credentials-optin.md @@ -0,0 +1,33 @@ +--- +worth: yes +where: backend/app/rest/api/middleware.go:127 +added: 2026-08-18 +--- +# corsMiddleware panics at boot once go-pkgz/rest is bumped past v1.22.0 + +`corsMiddleware` passes `R.CorsAllowedOrigins("*")` together with `R.CorsAllowCredentials(true)` +(lines 128 and 132). go-pkgz/rest#52 makes `rest.CORS` panic at construction on exactly that +combination, so the next bump of `github.com/go-pkgz/rest` past the pinned `v1.22.0` +(`backend/go.mod:16`) crashes remark42 on startup, not at request time. + +The fix is one option: + +```go +R.CorsAllowedOrigins("*"), +R.CorsAllowCredentials(true), +R.CorsUnsafeAnyOriginWithCredentials(true), +``` + +It cannot be added before the bump, since the option does not exist in v1.22.0. So this is bump and +edit in one commit, in either order within that commit, and it will not compile split across two. + +Why the wildcard stays rather than the origins being enumerated: remark42 serves a comment widget +embedded on arbitrary third-party sites, so the set of origins is not knowable. The upstream default +is right for a normal service and wrong here, which is why the escape hatch was asked for instead of +accepting the panic. The named consequence stands and is worth re-reading when this is touched: any +site a signed-in user visits can read authenticated responses, so state-changing requests must keep +being protected by something other than the origin (`X-XSRF-Token` today). + +Surfaced reviewing go-pkgz/rest#52. The unconditional panic in the original version of that PR was +pushed back on precisely because remark42 had no way to comply; `CorsUnsafeAnyOriginWithCredentials` +exists as a result.