Same-Origin policy prevents reading HTML pages cross-origin
Open, MediumPublic
Actions

Assigned To

None

Authored By

	dbarratt
	Jun 27 2020, 3:16 PM

Description

Problem
If a website would like to read the HTML pages in MediaWiki they are unable to do so because of the same-origin policy.

Proposed Solution
MediaWiki could add configuration that would add the Access-Control-Allow-Origin: * to all non-API requests. This is safe as long as MediaWiki is not being run on an intranet:

It is completely safe to augment any resource with Access-Control-Allow-Origin: * as long as the resource is not part of an intranet (behind a firewall).

https://annevankesteren.nl/2012/12/cors-101

A wiki should be able to opt-out (by default?) of this behavior since it is not safe to do this if the wiki is non-private and on an intranet (i.e. the only thing that secures the content is the firewall itself).

Related

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Set the Access-Control-Allow-Origin header for HTML pages	mediawiki/core	master	+4 -0

Customize query in gerrit

Related Objects

Mentioned In: T232176: Enable cross-origin resource sharing (CORS) for requests in Core REST API
T210790: Allow cross-origin requests by default in the Action API
Mentioned Here: T232176: Enable cross-origin resource sharing (CORS) for requests in Core REST API
T210790: Allow cross-origin requests by default in the Action API

Event Timeline

dbarratt created this task.Jun 27 2020, 3:16 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 27 2020, 3:16 PM

Change 608156 had a related patch set uploaded (by Dbarratt; owner: Dbarratt):
[mediawiki/core@master] Add config option to add Access-Control-Allow-Origin: * header

https://gerrit.wikimedia.org/r/608156

gerritbot added a project: Patch-For-Review.Jun 27 2020, 3:17 PM

dbarratt mentioned this in T210790: Allow cross-origin requests by default in the Action API.Jun 27 2020, 3:26 PM