gaschz/trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2025-11-26 02:24:23 +01:00
Code Issues Actions 12 Packages Projects Releases Wiki Activity

Fixes #7826 CORP (Resource Policy) defaults to same-origin (#7830)
Some checks are pending
Checks / main (push) Waiting to run
Details
CodeQL Advanced / Analyze (actions) (push) Waiting to run
Details
CodeQL Advanced / Analyze (javascript-typescript) (push) Waiting to run
Details
Deploy Documentation / Build and Deploy Documentation (push) Waiting to run
Details
Dev / Test development (push) Waiting to run
Details
Dev / Build Docker image (push) Blocked by required conditions
Details
Dev / Check Docker build (Dockerfile) (push) Blocked by required conditions
Details
Dev / Check Docker build (Dockerfile.alpine) (push) Blocked by required conditions
Details
/ Check Docker build (Dockerfile) (push) Waiting to run
Details
/ Check Docker build (Dockerfile.alpine) (push) Waiting to run
Details
/ Build Docker images (Dockerfile, ubuntu-24.04-arm, linux/arm64) (push) Blocked by required conditions
Details
/ Build Docker images (Dockerfile.alpine, ubuntu-latest, linux/amd64) (push) Blocked by required conditions
Details
/ Build Docker images (Dockerfile.legacy, ubuntu-24.04-arm, linux/arm/v7) (push) Blocked by required conditions
Details
/ Build Docker images (Dockerfile.legacy, ubuntu-24.04-arm, linux/arm/v8) (push) Blocked by required conditions
Details
/ Merge manifest lists (push) Blocked by required conditions
Details
playwright / E2E tests on linux-arm64 (push) Waiting to run
Details
playwright / E2E tests on linux-x64 (push) Waiting to run
Details

Browse Source
This commit is contained in:
Elian Doran 2025-11-24 09:21:58 +02:00 committed by GitHub
commit 71b86b3cbc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 63 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
apps/server/src/app.ts
View File

@ -56,10 +56,19 @@ export default async function buildApp() {
app.use(compression()); // HTTP compression
}
let resourcePolicy = config["Network"]["corsResourcePolicy"] as 'same-origin' | 'same-site' | 'cross-origin' | undefined;
if(resourcePolicy !== 'same-origin' && resourcePolicy !== 'same-site' && resourcePolicy !== 'cross-origin') {
log.error(`Invalid CORS Resource Policy value: '${resourcePolicy}', defaulting to 'same-origin'`);
resourcePolicy = 'same-origin';
}
app.use(
helmet({
hidePoweredBy: false, // errors out in electron
contentSecurityPolicy: false,
crossOriginResourcePolicy: {
policy: resourcePolicy
},
crossOriginEmbedderPolicy: false
})
);

13
apps/server/src/services/config.ts
View File

@ -97,6 +97,8 @@ export interface TriliumConfig {
corsAllowMethods: string;
/** CORS allowed headers (comma-separated header names) */
corsAllowHeaders: string;
/** CORS Resource Policy ('same-origin', 'same-site', 'cross-origin') */
corsResourcePolicy: string;
};
/** Session management configuration */
Session: {
@ -362,6 +364,12 @@ const configMapping = {
aliasEnvVars: ['TRILIUM_NETWORK_CORS_ALLOW_HEADERS'],
iniGetter: () => getIniSection("Network")?.corsAllowHeaders,
defaultValue: ''
},
corsResourcePolicy: {
standardEnvVar: 'TRILIUM_NETWORK_CORSRESOURCEPOLICY',
aliasEnvVars: ['TRILIUM_NETWORK_CORS_RESOURCE_POLICY'],
iniGetter: () => getIniSection("Network")?.corsResourcePolicy,
defaultValue: 'same-origin' as 'same-origin' | 'same-site' | 'cross-origin'
}
},
Session: {
@ -482,7 +490,8 @@ const config: TriliumConfig = {
trustedReverseProxy: getConfigValue(configMapping.Network.trustedReverseProxy),
corsAllowOrigin: getConfigValue(configMapping.Network.corsAllowOrigin),
corsAllowMethods: getConfigValue(configMapping.Network.corsAllowMethods),
corsAllowHeaders: getConfigValue(configMapping.Network.corsAllowHeaders)
corsAllowHeaders: getConfigValue(configMapping.Network.corsAllowHeaders),
corsResourcePolicy: getConfigValue(configMapping.Network.corsResourcePolicy)
},
Session: {
cookieMaxAge: getConfigValue(configMapping.Session.cookieMaxAge)
@ -539,6 +548,7 @@ const config: TriliumConfig = {
* - TRILIUM_NETWORK_CORSALLOWORIGIN : CORS allowed origins
* - TRILIUM_NETWORK_CORSALLOWMETHODS : CORS allowed HTTP methods
* - TRILIUM_NETWORK_CORSALLOWHEADERS : CORS allowed headers
* - TRILIUM_NETWORK_CORSRESOURCEPOLICY : CORS Resource Policy
*
* Session Section:
* - TRILIUM_SESSION_COOKIEMAXAGE : Cookie lifetime in seconds
@ -566,6 +576,7 @@ const config: TriliumConfig = {
* - TRILIUM_NETWORK_CORS_ALLOW_ORIGIN : Same as TRILIUM_NETWORK_CORSALLOWORIGIN
* - TRILIUM_NETWORK_CORS_ALLOW_METHODS : Same as TRILIUM_NETWORK_CORSALLOWMETHODS
* - TRILIUM_NETWORK_CORS_ALLOW_HEADERS : Same as TRILIUM_NETWORK_CORSALLOWHEADERS
* - TRILIUM_NETWORK_CORS_RESOURCE_POLICY : Same as TRILIUM_NETWORK_CORSRESOURCEPOLICY
*
* Sync (with SERVER prefix):
* - TRILIUM_SYNC_SERVER_HOST : Same as TRILIUM_SYNC_SYNCSERVERHOST

3
docs/User Guide/User Guide/Advanced Usage/Configuration (config.ini or e.md vendored
View File

@ -49,6 +49,7 @@ Additionally, shorter aliases are available for common configurations (see Alter
| `TRILIUM_NETWORK_CORSALLOWORIGIN` | string | "" | CORS allowed origins |
| `TRILIUM_NETWORK_CORSALLOWMETHODS` | string | "" | CORS allowed methods |
| `TRILIUM_NETWORK_CORSALLOWHEADERS` | string | "" | CORS allowed headers |
| `TRILIUM_NETWORK_CORSRESOURCEPOLICY` | string | same-origin | CORS Resource Policy allows same-origin/same-site/cross-origin as values, will error if not
### Session Section
@ -90,7 +91,7 @@ The following alternative environment variable names are also supported and work
* `TRILIUM_NETWORK_CORS_ALLOW_ORIGIN` (alternative to `TRILIUM_NETWORK_CORSALLOWORIGIN`)
* `TRILIUM_NETWORK_CORS_ALLOW_METHODS` (alternative to `TRILIUM_NETWORK_CORSALLOWMETHODS`)
* `TRILIUM_NETWORK_CORS_ALLOW_HEADERS` (alternative to `TRILIUM_NETWORK_CORSALLOWHEADERS`)
* `TRILIUM_NETWORK_CORS_RESOURCE_POLICY` (alternative to `TRILIUM_NETWORK_CORSRESOURCEPOLICY`)
### Sync Variables
* `TRILIUM_SYNC_SERVER_HOST` (alternative to `TRILIUM_SYNC_SYNCSERVERHOST`)