github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2025-04-20 02:03:48 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #11489 from overleaf/em-fix-paypal

Browse source 
Set COOP header to same-origin-allow-popups

GitOrigin-RevId: c8c3751386addb307ee2caf59c228484e8e593c0
This commit is contained in:
Eric Mc Sween 2023-01-26 14:39:10 -05:00 • committed by Copybot
parent dad1460d71
commit 2dbc0e3b3d
2 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
services/web/app/src/infrastructure/Server.js
View file

@ -272,6 +272,9 @@ webRouter.use(
// Disabled because it's impractical to include every resource via CORS or
// with the magic CORP header
crossOriginEmbedderPolicy: false,
// We need to be able to share the context of some popups. For example,
// when Recurly opens Paypal in a popup.
crossOriginOpenerPolicy: { policy: 'same-origin-allow-popups' },
// Disabled because it's not a security header and has possibly-unwanted
// effects
originAgentCluster: false,

2
services/web/test/acceptance/src/SecurityHeadersTests.js
View file

@ -23,7 +23,7 @@ const assert_has_common_headers = function (response) {
'x-download-options': 'noopen',
'x-xss-protection': '0',
'cross-origin-resource-policy': 'same-origin',
'cross-origin-opener-policy': 'same-origin',
'cross-origin-opener-policy': 'same-origin-allow-popups',
'x-content-type-options': 'nosniff',
'x-permitted-cross-domain-policies': 'none',
'referrer-policy': 'origin-when-cross-origin',