Dmitry Verkhoturov
10c5b158db
The R1 mechanism was reasoned from the code and checked on Chromium. Running it on two genuinely different registrable domains with real certificates, across Chromium, Firefox, WebKit and Safari 27, shows the arrangement working everywhere except Firefox's opt-in block-all, and working by two different mechanisms. Chromium, WebKit and Safari refuse the server's pair, because AUTH_SAME_SITE defaults to emitting no SameSite attribute and a cross-site cookie without one is rejected; that refusal is what lets the widget's partitioned pair land. Firefox accepts it, and since that cookie is HttpOnly the browser then forbids the widget's script from replacing it, so Firefox holds no partitioned copy and rides on an ordinary third-party cookie even with the flag on. Safari blocks third-party cookies with nothing configured, which makes AUTH_SAME_SITE=none alone already broken there rather than deprecated. It also changes what the upstream Partitioned work is worth, which this section had written off twice. Building go-pkgz/auth with the option and running the same matrix gives the same persistence with the JWT still HttpOnly: on Safari, document.cookie inside the frame returns the token under the header flag and does not under the partitioned build. The header path's XSS cost is avoidable, not inherent, so both paths are better with the upstream change even though neither depends on it.
Remark42 
Remark42 is a self-hosted, lightweight and simple (yet functional) comment engine, which doesn't spy on users. It can be embedded into blogs, articles, or any other place where readers add comments.
- Social login via Google, Facebook, Microsoft, GitHub, Apple, Yandex, Patreon, Discord, Telegram and custom OAuth2 providers
- Login via email
- Optional anonymous access
- Multi-level nested comments with both tree and plain presentations
- Import from Disqus and WordPress
- Markdown support with friendly formatter toolbar
- Moderator can remove comments and block users
- Voting, pinning and verification system
- Sortable comments
- Images upload with drag-and-drop
- Extractor for recent comments, cross-post
- RSS for all comments and each post
- Telegram, Slack, Webhook and email notifications for Admins (get notified for each new comment)
- Email and Telegram notifications for users (get notified when someone responds to your comment)
- Export data to JSON with automatic backups
- No external databases, everything embedded in a single data file
- Fully dockerized and can be deployed in a single command
- Self-contained executable can be deployed directly to Linux, Windows and macOS
- Clean, lightweight and customizable UI with white and dark themes
- Multi-site mode from a single instance
- Integration with automatic SSL (direct and via nginx-le)
- Privacy focused
Demo site available with all authentication methods, including email auth and anonymous access.
All remark42 documentation is available by the link.
Contribution
In order to start and work on the project locally in development mode check our contribution documentation for backend and frontend.
If you are interested in adding a new localization please check these docs.