sergehuber opened a new pull request, #920: URL: https://github.com/apache/unomi/pull/920
## Summary - Public tracker endpoints (`context.json`, `eventcollector`, `client`) still accept any origin and do not allow cookies unless the operator lists that origin in `UNOMI_PUBLIC_CORS_ALLOWED_ORIGINS`. - A listed origin is named exactly in the response, with credentials and `Vary: Origin`, including preflight. An unlisted origin, a different scheme or port, a subdomain, `*`, and `null` are refused. The visitor cookie from an unlisted origin is not bound to that profile. Requests with no `Origin` header behave as before. - `SameSite=None` is used only when the cookie is also `Secure` and the origin list is not empty. Otherwise the cookie stays `SameSite=Lax`. - The tracker option to send requests without cookies is in apache/unomi-tracker (`sendCredentials: false`). Existing tracker pages keep sending cookies and work once their origin is listed. ## Test plan - [x] `PublicTrackerCorsPolicyTest`, `PublicTrackerCorsFilterTest` - [x] `ProfileCookieSameSiteTest` - [x] `RestServiceUtilsImplProfileBindingTest` (listed origin uses the cookie; unlisted origin does not) - [x] `ShippedProfileCookieConfigTest` (environment variables reach the settings) - [x] `PublicTrackerCorsTest` (annotation still does not allow credentials for every origin) - [ ] Manual: listed origin on another domain with the shipped tracker; unlisted origin fails -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
