Skip to content

v0.4.2

Choose a tag to compare

View all tags
@sergeychernyshev sergeychernyshev released this 29 Jun 02:39
v0.4.2
ff1d380
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch — fixes atproto login form (regression in 0.4.1)

Fixed

  • The "Login with your Atmosphere account" form now submits. The hardened CSP added in 0.4.1 included form-action 'self', which blocked the form submission: the form posts to our endpoint, which 302-redirects to the user's own authorization server (cross-origin), and form-action is enforced across the whole redirect chain. Symptom was the form "doing nothing" while navigating to the auth URL directly worked. Removed the form-action directive (incompatible with a login form that redirects to per-user auth servers); all other hardening — default-src 'none', frame-ancestors 'none', style-src 'self', nosniff, no-store — stays.

Full changelog: #107

Assets 2
Loading