Git-Mirrors/invidious
1
0
Fork 0
mirror of https://github.com/iv-org/invidious.git synced 2025-04-10 18:19:09 -04:00
Code Issues Packages Projects Releases Wiki Activity

remove cookie restrictions

Browse Source 
Having to check if the cookie is inside a list of allowed domains on
invidious doesn't seem really useful because a reverse proxy like NGINX
and HAProxy will only send the client request to Invidious if the Host header
that the client sent to the server, matches with the `hdr(host)` (haproxy) or
`server_name` (nginx) set by the server configuration.
This commit is contained in:
Fijxu 2025-03-31 23:18:51 -03:00
parent 844c0ee60b
commit b4b0a8ab75
No known key found for this signature in database
GPG Key ID: 32C1DDF333EDA6A4
2 changed files with 5 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/invidious/routes/login.cr
View File

@ -60,13 +60,7 @@ module Invidious::Routes::Login
sid = Base64.urlsafe_encode(Random::Secure.random_bytes(32))
Invidious::Database::SessionIDs.insert(sid, email)
# Checks if there is any alternative domain, like a second domain name,
# TOR or I2P address
if alt = CONFIG.alternative_domains.index(env.request.headers["Host"])
env.response.cookies["SID"] = Invidious::User::Cookies.sid(CONFIG.alternative_domains[alt], sid)
else
env.response.cookies["SID"] = Invidious::User::Cookies.sid(CONFIG.domain, sid)
end
env.response.cookies["SID"] = Invidious::User::Cookies.sid(env.request.headers["Host"], sid)
else
return error_template(401, "Wrong username or password")
end
@ -169,13 +163,7 @@ module Invidious::Routes::Login
view_name = "subscriptions_#{sha256(user.email)}"
PG_DB.exec("CREATE MATERIALIZED VIEW #{view_name} AS #{MATERIALIZED_VIEW_SQL.call(user.email)}")
# Checks if there is any alternative domain, like a second domain name,
# TOR or I2P address
if alt = CONFIG.alternative_domains.index(env.request.headers["Host"])
env.response.cookies["SID"] = Invidious::User::Cookies.sid(CONFIG.alternative_domains[alt], sid)
else
env.response.cookies["SID"] = Invidious::User::Cookies.sid(CONFIG.domain, sid)
end
env.response.cookies["SID"] = Invidious::User::Cookies.sid(env.request.headers["Host"], sid)
if env.request.cookies["PREFS"]?
user.preferences = env.get("preferences").as(Preferences)

18
src/invidious/routes/preferences.cr
View File

@ -223,14 +223,8 @@ module Invidious::Routes::PreferencesRoute
File.write("config/config.yml", CONFIG.to_yaml)
end
else
# Checks if there is any alternative domain, like a second domain name,
# TOR or I2P address
if alt = CONFIG.alternative_domains.index(env.request.headers["Host"])
env.response.cookies["PREFS"] = Invidious::User::Cookies.prefs(CONFIG.alternative_domains[alt], preferences)
else
env.response.cookies["PREFS"] = Invidious::User::Cookies.prefs(CONFIG.domain, preferences)
end
env.response.cookies["PREFS"] = Invidious::User::Cookies.prefs(env.request.headers["Host"], preferences)
end
env.redirect referer
@ -265,13 +259,7 @@ module Invidious::Routes::PreferencesRoute
preferences.dark_mode = "dark"
end
# Checks if there is any alternative domain, like a second domain name,
# TOR or I2P address
if alt = CONFIG.alternative_domains.index(env.request.headers["Host"])
env.response.cookies["PREFS"] = Invidious::User::Cookies.prefs(CONFIG.alternative_domains[alt], preferences)
else
env.response.cookies["PREFS"] = Invidious::User::Cookies.prefs(CONFIG.domain, preferences)
end
env.response.cookies["PREFS"] = Invidious::User::Cookies.prefs(env.request.headers["Host"], preferences)
end
if redirect