discourse

mirror of https://github.com/discourse/discourse.git synced 2025-05-21 09:36:11 +08:00

History

DEV: ensure Rails application default headers are present in responses (#31619 )

Follow up from https://github.com/discourse/discourse/pull/31559.

We expect some standard headers to be added from
`Rails.application.config.action_dispatch.default_headers` for
responses, however these were found to be removed in some error paths. 
For more detail on this behaviour, refer to https://github.com/discourse/discourse/pull/31619#issuecomment-2699644232.

This PR adds those headers back if they aren't there, with the caveats
that we don't add headers that are irrelevant for non-HTML responses,
and neither do we add X-Frame-Options which is intentionally removed for
embeddables.

2025-03-05 13:19:09 +08:00

anonymous_cache.rb

FIX: Incorrect topic per-minute invitation rate limit (#31252 )

2025-02-10 13:12:16 +10:00

csp_script_nonce_injector.rb

DEV: Memoize CSP nonce placeholder on response (#25724 )

2024-02-16 12:15:55 +00:00

default_headers.rb

DEV: ensure Rails application default headers are present in responses (#31619 )

2025-03-05 13:19:09 +08:00

discourse_public_exceptions.rb

FIX: cross origin opener policy should apply to public error responses (#31559 )