diff options
| author | Thomas Citharel <tcit@tcit.fr> | 2022-11-04 09:43:13 +0100 |
|---|---|---|
| committer | Thomas Citharel <tcit@tcit.fr> | 2022-11-04 09:43:13 +0100 |
| commit | bdedc41cbc60cc699e44ff323b945c276af32122 (patch) | |
| tree | 823f066747aa674b5089f6d12c24413aadf8cd16 | |
| parent | 9f708037d75af86591890e09e30185b7ec64810c (diff) | |
| download | pleroma-bdedc41cbc60cc699e44ff323b945c276af32122.tar.gz pleroma-bdedc41cbc60cc699e44ff323b945c276af32122.zip | |
Fix typo in CSP Report-To header name
The header name was Report-To, not Reply-To.
In any case, that's now being changed to the Reporting-Endpoints HTTP
Response Header.
https://w3c.github.io/reporting/#header
https://github.com/w3c/reporting/issues/177
CanIUse says the Report-To header is still supported by current Chrome
and friends.
https://caniuse.com/mdn-http_headers_report-to
It doesn't have any data for the Reporting-Endpoints HTTP header, but
this article says Chrome 96 supports it.
https://web.dev/reporting-api/
(Even though that's come out one year ago, that's not compatible with
Network Error Logging which's still using the Report-To version of the
API)
Signed-off-by: Thomas Citharel <tcit@tcit.fr>
| -rw-r--r-- | lib/pleroma/web/plugs/http_security_plug.ex | 2 | ||||
| -rw-r--r-- | test/pleroma/web/plugs/http_security_plug_test.exs | 4 |
2 files changed, 3 insertions, 3 deletions
diff --git a/lib/pleroma/web/plugs/http_security_plug.ex b/lib/pleroma/web/plugs/http_security_plug.ex index b89948cec..cd1bae235 100644 --- a/lib/pleroma/web/plugs/http_security_plug.ex +++ b/lib/pleroma/web/plugs/http_security_plug.ex @@ -68,7 +68,7 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do ] } - [{"reply-to", Jason.encode!(report_group)} | headers] + [{"report-to", Jason.encode!(report_group)} | headers] else headers end diff --git a/test/pleroma/web/plugs/http_security_plug_test.exs b/test/pleroma/web/plugs/http_security_plug_test.exs index e1e97c1ce..c79170382 100644 --- a/test/pleroma/web/plugs/http_security_plug_test.exs +++ b/test/pleroma/web/plugs/http_security_plug_test.exs @@ -59,9 +59,9 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlugTest do assert csp =~ ~r|report-uri https://endpoint.com;report-to csp-endpoint;| - [reply_to] = Conn.get_resp_header(conn, "reply-to") + [report_to] = Conn.get_resp_header(conn, "report-to") - assert reply_to == + assert report_to == "{\"endpoints\":[{\"url\":\"https://endpoint.com\"}],\"group\":\"csp-endpoint\",\"max-age\":10886400}" end |