gaschz/trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2025-11-26 02:24:23 +01:00
Code Issues Actions 12 Packages Projects Releases Wiki Activity

feat(config): add CORS Resource Policy configuration

Browse Source
This commit is contained in:
lzinga 2025-11-21 11:30:29 -08:00
parent a3f1e46107
commit e7dbaf78b5
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
apps/server/src/app.ts
View File

@ -60,6 +60,9 @@ export default async function buildApp() {
helmet({
hidePoweredBy: false, // errors out in electron
contentSecurityPolicy: false,
crossOriginResourcePolicy: {
policy: config["Network"]["corsResourcePolicy"] || 'same-origin'
},
crossOriginEmbedderPolicy: false
})
);

13
apps/server/src/services/config.ts
View File

@ -97,6 +97,8 @@ export interface TriliumConfig {
corsAllowMethods: string;
/** CORS allowed headers (comma-separated header names) */
corsAllowHeaders: string;
/** CORS Resource Policy ('same-origin', 'same-site' 'cross-origin') */
corsResourcePolicy: 'same-origin' | 'same-site' | 'cross-origin' | undefined;
};
/** Session management configuration */
Session: {
@ -362,6 +364,12 @@ const configMapping = {
aliasEnvVars: ['TRILIUM_NETWORK_CORS_ALLOW_HEADERS'],
iniGetter: () => getIniSection("Network")?.corsAllowHeaders,
defaultValue: ''
},
corsResourcePolicy: {
standardEnvVar: 'TRILIUM_NETWORK_CORSRESOURCEPOLICY',
aliasEnvVars: ['TRILIUM_NETWORK_CORS_RESOURCE_POLICY'],
iniGetter: () => getIniSection("Network")?.corsResourcePolicy,
defaultValue: ''
}
},
Session: {
@ -482,7 +490,8 @@ const config: TriliumConfig = {
trustedReverseProxy: getConfigValue(configMapping.Network.trustedReverseProxy),
corsAllowOrigin: getConfigValue(configMapping.Network.corsAllowOrigin),
corsAllowMethods: getConfigValue(configMapping.Network.corsAllowMethods),
corsAllowHeaders: getConfigValue(configMapping.Network.corsAllowHeaders)
corsAllowHeaders: getConfigValue(configMapping.Network.corsAllowHeaders),
corsResourcePolicy: getConfigValue(configMapping.Network.corsResourcePolicy)
},
Session: {
cookieMaxAge: getConfigValue(configMapping.Session.cookieMaxAge)
@ -539,6 +548,7 @@ const config: TriliumConfig = {
* - TRILIUM_NETWORK_CORSALLOWORIGIN : CORS allowed origins
* - TRILIUM_NETWORK_CORSALLOWMETHODS : CORS allowed HTTP methods
* - TRILIUM_NETWORK_CORSALLOWHEADERS : CORS allowed headers
* - TRILIUM_NETWORK_CORSRESOURCEPOLICY : CORS Resource Policy
*
* Session Section:
* - TRILIUM_SESSION_COOKIEMAXAGE : Cookie lifetime in seconds
@ -566,6 +576,7 @@ const config: TriliumConfig = {
* - TRILIUM_NETWORK_CORS_ALLOW_ORIGIN : Same as TRILIUM_NETWORK_CORSALLOWORIGIN
* - TRILIUM_NETWORK_CORS_ALLOW_METHODS : Same as TRILIUM_NETWORK_CORSALLOWMETHODS
* - TRILIUM_NETWORK_CORS_ALLOW_HEADERS : Same as TRILIUM_NETWORK_CORSALLOWHEADERS
* - TRILIUM_NETWORK_CORS_RESOURCE_POLICY : Same as TRILIUM_NETWORK_CORSRESOURCEPOLICY
*
* Sync (with SERVER prefix):
* - TRILIUM_SYNC_SERVER_HOST : Same as TRILIUM_SYNC_SYNCSERVERHOST