FEATURE: Use group based setting for unsafe-none COOP (#27783)

Followup 3ff7ce78e782c7d28c8b5a1a3f40a1de897d89a1

Basing this setting on referrer was too brittle --
the referrer header can easily be ommitted or changed.
Instead, for the small amount of use cases that this
site setting serves, we can use a group-based setting
instead, changing it to `cross_origin_opener_unsafe_none_groups`
instead.
This commit is contained in:
Martin Brennan
2024-07-10 02:25:49 +10:00
committed by GitHub
parent a01be4150a
commit 7a7bdc9be5
4 changed files with 49 additions and 32 deletions

View File

@ -0,0 +1,14 @@
# frozen_string_literal: true
class RemoveCrossOriginUnsafeNoneReferrersSetting < ActiveRecord::Migration[7.1]
def up
execute <<~SQL
DELETE FROM site_settings
WHERE name = 'cross_origin_opener_unsafe_none_referrers'
SQL
end
def down
raise ActiveRecord::IrreversibleMigration
end
end