gaschz/trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2025-11-26 02:24:23 +01:00
Code Issues Actions 11 Packages Projects Releases Wiki Activity

feat(config): add CORS Resource Policy configuration

Browse Source
This commit is contained in:
lzinga 2025-11-21 11:30:29 -08:00
parent a3f1e46107
commit e7dbaf78b5
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
apps/server/src/app.ts
View File

@ -60,6 +60,9 @@ export default async function buildApp() {
helmet({ helmet({
hidePoweredBy: false, // errors out in electron hidePoweredBy: false, // errors out in electron
contentSecurityPolicy: false, contentSecurityPolicy: false,
crossOriginResourcePolicy: {
policy: config["Network"]["corsResourcePolicy"] || 'same-origin'
},
crossOriginEmbedderPolicy: false crossOriginEmbedderPolicy: false
}) })
); );

13
apps/server/src/services/config.ts
View File

@ -97,6 +97,8 @@ export interface TriliumConfig {
corsAllowMethods: string; corsAllowMethods: string;
/** CORS allowed headers (comma-separated header names) */ /** CORS allowed headers (comma-separated header names) */
corsAllowHeaders: string; corsAllowHeaders: string;
/** CORS Resource Policy ('same-origin', 'same-site' 'cross-origin') */
corsResourcePolicy: 'same-origin' | 'same-site' | 'cross-origin' | undefined;
}; };
/** Session management configuration */ /** Session management configuration */
Session: { Session: {
@ -362,6 +364,12 @@ const configMapping = {
aliasEnvVars: ['TRILIUM_NETWORK_CORS_ALLOW_HEADERS'], aliasEnvVars: ['TRILIUM_NETWORK_CORS_ALLOW_HEADERS'],
iniGetter: () => getIniSection("Network")?.corsAllowHeaders, iniGetter: () => getIniSection("Network")?.corsAllowHeaders,
defaultValue: '' defaultValue: ''
},
corsResourcePolicy: {
standardEnvVar: 'TRILIUM_NETWORK_CORSRESOURCEPOLICY',
aliasEnvVars: ['TRILIUM_NETWORK_CORS_RESOURCE_POLICY'],
iniGetter: () => getIniSection("Network")?.corsResourcePolicy,
defaultValue: ''
} }
}, },
Session: { Session: {
@ -482,7 +490,8 @@ const config: TriliumConfig = {
trustedReverseProxy: getConfigValue(configMapping.Network.trustedReverseProxy), trustedReverseProxy: getConfigValue(configMapping.Network.trustedReverseProxy),
corsAllowOrigin: getConfigValue(configMapping.Network.corsAllowOrigin), corsAllowOrigin: getConfigValue(configMapping.Network.corsAllowOrigin),
corsAllowMethods: getConfigValue(configMapping.Network.corsAllowMethods), corsAllowMethods: getConfigValue(configMapping.Network.corsAllowMethods),
corsAllowHeaders: getConfigValue(configMapping.Network.corsAllowHeaders) corsAllowHeaders: getConfigValue(configMapping.Network.corsAllowHeaders),
corsResourcePolicy: getConfigValue(configMapping.Network.corsResourcePolicy)
}, },
Session: { Session: {
cookieMaxAge: getConfigValue(configMapping.Session.cookieMaxAge) cookieMaxAge: getConfigValue(configMapping.Session.cookieMaxAge)
@ -539,6 +548,7 @@ const config: TriliumConfig = {
* - TRILIUM_NETWORK_CORSALLOWORIGIN : CORS allowed origins * - TRILIUM_NETWORK_CORSALLOWORIGIN : CORS allowed origins
* - TRILIUM_NETWORK_CORSALLOWMETHODS : CORS allowed HTTP methods * - TRILIUM_NETWORK_CORSALLOWMETHODS : CORS allowed HTTP methods
* - TRILIUM_NETWORK_CORSALLOWHEADERS : CORS allowed headers * - TRILIUM_NETWORK_CORSALLOWHEADERS : CORS allowed headers
* - TRILIUM_NETWORK_CORSRESOURCEPOLICY : CORS Resource Policy
* *
* Session Section: * Session Section:
* - TRILIUM_SESSION_COOKIEMAXAGE : Cookie lifetime in seconds * - TRILIUM_SESSION_COOKIEMAXAGE : Cookie lifetime in seconds
@ -566,6 +576,7 @@ const config: TriliumConfig = {
* - TRILIUM_NETWORK_CORS_ALLOW_ORIGIN : Same as TRILIUM_NETWORK_CORSALLOWORIGIN * - TRILIUM_NETWORK_CORS_ALLOW_ORIGIN : Same as TRILIUM_NETWORK_CORSALLOWORIGIN
* - TRILIUM_NETWORK_CORS_ALLOW_METHODS : Same as TRILIUM_NETWORK_CORSALLOWMETHODS * - TRILIUM_NETWORK_CORS_ALLOW_METHODS : Same as TRILIUM_NETWORK_CORSALLOWMETHODS
* - TRILIUM_NETWORK_CORS_ALLOW_HEADERS : Same as TRILIUM_NETWORK_CORSALLOWHEADERS * - TRILIUM_NETWORK_CORS_ALLOW_HEADERS : Same as TRILIUM_NETWORK_CORSALLOWHEADERS
* - TRILIUM_NETWORK_CORS_RESOURCE_POLICY : Same as TRILIUM_NETWORK_CORSRESOURCEPOLICY
* *
* Sync (with SERVER prefix): * Sync (with SERVER prefix):
* - TRILIUM_SYNC_SERVER_HOST : Same as TRILIUM_SYNC_SYNCSERVERHOST * - TRILIUM_SYNC_SERVER_HOST : Same as TRILIUM_SYNC_SYNCSERVERHOST