Skip to content

Properly fix CORS in PO token web views #8203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Nov 2, 2025
Merged

Properly fix CORS in PO token web views #8203

merged 1 commit into from
Nov 2, 2025
+17 −1

Conversation

@absidue
Copy link
Member

@absidue absidue commented Oct 31, 2025

Pull Request Type

  • Security improvement

Description

Currently we set the webSecurity option to false in the PO token web views, which as the name implies disables various security features, this pull request switches to using the webRequest.onHeadersReceived callback to override the CORS headers, so we no longer need to set webSecurity to false.

Testing

Open a video and check that it plays.

Desktop

  • OS: Windows
  • OS Version: 11

@github-actions github-actions bot added the PR: waiting for review For PRs that are complete, tested, and ready for review label Oct 31, 2025
@FreeTubeBot FreeTubeBot enabled auto-merge (squash) October 31, 2025 18:39
@FreeTubeBot FreeTubeBot merged commit 796fc4e into FreeTubeApp:development Nov 2, 2025
5 checks passed
@github-actions github-actions bot removed the PR: waiting for review For PRs that are complete, tested, and ready for review label Nov 2, 2025
@absidue absidue deleted the potoken-web-security branch November 2, 2025 09:08
PikachuEXE added a commit to PikachuEXE/FreeTube that referenced this pull request Nov 3, 2025
@PikachuEXE
Merge branch 'development' into feature/windows/settings-in-same-folder
f07afab 
* development: (325 commits)
  Replace vue-portal dependency with Vue's built-in <Teleport> component (FreeTubeApp#8207)
  Update to Vue 3 (FreeTubeApp#8094)
  Translated using Weblate (Basque)
  Translated using Weblate (Hungarian)
  Translated using Weblate (Icelandic)
  Translated using Weblate (Turkish)
  Properly fix CORS in PO token web views (FreeTubeApp#8203)
  Translated using Weblate (Italian)
  Translated using Weblate (Norwegian Bokmål)
  Translated using Weblate (French)
  Configure nedb to always clean up corrupted data (FreeTubeApp#8202)
  Translated using Weblate (Portuguese (Brazil))
  Add video paused check to frame shortcuts (FreeTubeApp#8200)
  Fix toast with timeout 0 will be displayed for default 3s (FreeTubeApp#8168)
  Translated using Weblate (Chinese (Simplified Han script))
  Change containing text input limit (FreeTubeApp#8174)
  Translated using Weblate (Dutch)
  Add support for AppImageUpdate (FreeTubeApp#8153)
  Added New Window option to Tray (FreeTubeApp#7995)
  Translated using Weblate (Japanese)
  ...
PikachuEXE added a commit to PikachuEXE/FreeTube that referenced this pull request Nov 3, 2025
@PikachuEXE
Merge branch 'development' into sabr-pr
2d22a9a 
* development: (21 commits)
  Replace vue-portal dependency with Vue's built-in <Teleport> component (FreeTubeApp#8207)
  Update to Vue 3 (FreeTubeApp#8094)
  Translated using Weblate (Basque)
  Translated using Weblate (Hungarian)
  Translated using Weblate (Icelandic)
  Translated using Weblate (Turkish)
  Properly fix CORS in PO token web views (FreeTubeApp#8203)
  Translated using Weblate (Italian)
  Translated using Weblate (Norwegian Bokmål)
  Translated using Weblate (French)
  Configure nedb to always clean up corrupted data (FreeTubeApp#8202)
  Translated using Weblate (Portuguese (Brazil))
  Add video paused check to frame shortcuts (FreeTubeApp#8200)
  Fix toast with timeout 0 will be displayed for default 3s (FreeTubeApp#8168)
  Translated using Weblate (Chinese (Simplified Han script))
  Change containing text input limit (FreeTubeApp#8174)
  Translated using Weblate (Dutch)
  Add support for AppImageUpdate (FreeTubeApp#8153)
  Added New Window option to Tray (FreeTubeApp#7995)
  Translated using Weblate (Japanese)
  ...
PikachuEXE added a commit to NishPatel101/FreeTube that referenced this pull request Nov 3, 2025
@PikachuEXE
Merge branch 'development' into feat/clickable-playlist-progressbar
9459e23 
* development: (38 commits)
  Replace vue-portal dependency with Vue's built-in <Teleport> component (FreeTubeApp#8207)
  Update to Vue 3 (FreeTubeApp#8094)
  Translated using Weblate (Basque)
  Translated using Weblate (Hungarian)
  Translated using Weblate (Icelandic)
  Translated using Weblate (Turkish)
  Properly fix CORS in PO token web views (FreeTubeApp#8203)
  Translated using Weblate (Italian)
  Translated using Weblate (Norwegian Bokmål)
  Translated using Weblate (French)
  Configure nedb to always clean up corrupted data (FreeTubeApp#8202)
  Translated using Weblate (Portuguese (Brazil))
  Add video paused check to frame shortcuts (FreeTubeApp#8200)
  Fix toast with timeout 0 will be displayed for default 3s (FreeTubeApp#8168)
  Translated using Weblate (Chinese (Simplified Han script))
  Change containing text input limit (FreeTubeApp#8174)
  Translated using Weblate (Dutch)
  Add support for AppImageUpdate (FreeTubeApp#8153)
  Added New Window option to Tray (FreeTubeApp#7995)
  Translated using Weblate (Japanese)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PikachuEXE PikachuEXE PikachuEXE approved these changes

@efb4f5ff-1298-471a-8973-3d47447115dc efb4f5ff-1298-471a-8973-3d47447115dc efb4f5ff-1298-471a-8973-3d47447115dc approved these changes

@kommunarr kommunarr kommunarr approved these changes

@ChunkyProgrammer ChunkyProgrammer Awaiting requested review from ChunkyProgrammer

@MarmadileManteater MarmadileManteater Awaiting requested review from MarmadileManteater

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@absidue @PikachuEXE @efb4f5ff-1298-471a-8973-3d47447115dc @kommunarr @FreeTubeBot