c67214b7d0
Our frontend requests the `/me` pathname in order to determine whether
it's logged in or not. Due to the fact that the sameSite attribute of
the session cookie was set to `strict` in a previous commit, the session
token was no longer sent along with HTTP calls initiated by JS. This is
due to the RFCs definition of "safe" HTTP calls in RFC7231.
The bug triggers the UI to show up like an unauthenticated user, even
after a successful login. In order to debug it a look into the send
cookies to the `/me` turned out to be very enlightening.
The fix this patch implements is rather simple, it replaces the sameSite
attribute to `lax` which enables the cookies for those requests again.
Some older and mobile clients were unaffected by this due to the lack of
implementations of sameSite policies.
References:
https://tools.ietf.org/html/rfc7231#section-4.2.1
https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-05#section-5.3.7.1
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
|
||
|---|---|---|
| bin | ||
| docs | ||
| locales | ||
| public | ||
| src | ||
| .babelrc | ||
| .editorconfig | ||
| .eslintignore | ||
| .eslintrc.js | ||
| .gitignore | ||
| .mailmap | ||
| .sequelizerc.example | ||
| .travis.yml | ||
| app.json | ||
| AUTHORS | ||
| CHANGELOG.md | ||
| CODE_OF_CONDUCT.md | ||
| config.json.example | ||
| CONTRIBUTING.md | ||
| LICENSE | ||
| package.json | ||
| README.md | ||
| SECURITY.md | ||
| tsconfig.json | ||
| webpack.common.js | ||
| webpack.dev.js | ||
| webpack.htmlexport.js | ||
| webpack.prod.js | ||
| yarn.lock | ||
CodiMD
CodiMD lets you create real-time collaborative markdown notes. You can test-drive it by visiting our CodiMD demo server.
It is inspired by Hackpad, Etherpad and similar collaborative editors. This project originated with the team at HackMD and now forked into its own organisation. A longer writeup can be read in the history doc.
Community and Contributions
We welcome contributions! There's a lot to do: If you would like to report bugs, the issue tracker is the right place. If you can help translating, find us on POEditor. To get started developing, take a look at the docs/dev directory. In any case: come talk to us, we'll be delighted to help you with the first steps.
To stay up to date with our work or get support it's recommended to join our Matrix channel, stop by our community forums or subscribe to the release feed. We also engage in regular community calls (RSS) which you are very welcome to join.
Installation / Upgrading
You can run CodiMD in a number of ways, and we created setup instructions for all of these:
If you do not wish to run your own setup, you can find a commercial offering at https://hackmd.io. This is not the same codebase as this one, but it is a very similar project.
Configuration
Theres two main ways to configure your CodiMD instance: Config file or environment variables. You can choose what works best for you.
CodiMD can integrate with
- facebook, twitter, github, gitlab, dropbox, google, ldap, saml and oauth2 for login
- imgur, s3, minio, azure for image/attachment storage (files can also be local!)
- dropbox for export and import
More info about that can be found in the configuration docs above.
Browser support
To use CodiMD, your browser should match or exceed these versions:
Chrome >= 47, Chrome for Android >= 47
Safari >= 9, 
iOS Safari >= 8.4
Firefox >= 44
IE >= 9, 
Edge >= 12
Opera >= 34, 
Opera Mini not supported
Android Browser >= 4.4
Related Tools
Our community has created related tools, we'd like to highlight codimd-cli which lets you use CodiMD from the comfort of your command line.
License
Licensed under AGPLv3. For our list of contributors, see AUTHORS.