feat: serve user pages on per-page subdomains for origin isolation #2
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "fix/subdomain-isolation-security-headers"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Uploaded HTML now served at
{page_id}.{CONTENT_DOMAIN}instead of/p/{page_id}on the app origin, preventing token theft via localStorage.Adds security headers middleware for app routes and content headers (
noindex,no-store) on served pages.Adds
--proxy-headersto uvicorn.Uploaded HTML now served at {page_id}.{CONTENT_DOMAIN} instead of /p/{page_id} on the app origin, preventing token theft via localStorage. Adds security headers middleware for app routes and content headers (noindex, no-store) on served pages. Adds --proxy-headers to uvicorn.Uploaded HTML now served at {page_id}.{CONTENT_DOMAIN} instead of /p/{page_id} on the app origin, preventing token theft via localStorage. Adds security headers middleware for app routes and content headers (noindex, no-store) on served pages. Adds --proxy-headers to uvicorn.