mirror of
https://github.com/discourse/discourse.git
synced 2025-06-02 04:08:41 +08:00
38abc0d922
Why this change? This is part of our efforts to harden the security of the Discourse application. Setting the `CROSS_ORIGIN_OPENER_POLICY` header to `same-origin-allow-popups` by default makes the application safer. We have opted to make this a hidden site setting because most admins will never have to care about this setting so we're are opting not to show it. If they do have to change it, they can still do so by setting the `DISCOURSE_CROSS_ORIGIN_OPENER_POLICY` env.