main · last commit
1 month ago ·
2npkec0r
tarantool-etcd-c7a No --cors or --host-whitelist on the JSON gateway
Lined Up
bd update tarantool-etcd-c7a --claim
bd close tarantool-etcd-c7a
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-07-17T13:22:00Z |
| Updated | 2026-07-17T13:22:00Z |
etcd supports CORS headers plus preflight on /v3/*, and Host validation as a DNS-rebinding guard. Zero hits for 'cors|access-control' repo-wide. app/etcd/json.lua:623-624 rejects any non-POST, so an OPTIONS preflight returns code-12 rather than the CORS response. Nothing reads req.headers['host']. Impact: browser-origin clients cannot use the gateway cross-origin. Host-whitelist absence is a real (if low) DNS-rebinding exposure for anyone exposing the gateway to a browser-reachable network. Judgment call: closest to pure config-surface parity of anything in this sweep; a reviewer could reasonably close this as out-of-scope given our config system differs structurally from etcd's flags. Filed for the decision. Note the third related knob — gateway response size — is N/A by construction: json.lua:653-699 dispatches in-process, with no internal gRPC client to cap.
OPTIONS preflight answered with Access-Control-* when a cors option is set; Host validated against a whitelist when configured; both default to today's behavior.
No outgoing dependencies.
Nothing depends on this issue.
| id | tarantool-etcd-c7a |
| content_hash | 8a87b52a2475077799b652cb9aeefc4490249c0786dc9c25f4d09eb922e95f1f |
| title | No --cors or --host-whitelist on the JSON gateway |
| description | etcd supports CORS headers plus preflight on /v3/*, and Host validation as a DNS-rebinding guard. Zero hits for 'cors|access-control' repo-wide. app/etcd/json.lua:623-624 rejects any non-POST, so an OPTIONS preflight returns code-12 rather than the CORS response. Nothing reads req.headers['host']. Impact: browser-origin clients cannot use the gateway cross-origin. Host-whitelist absence is a real (if low) DNS-rebinding exposure for anyone exposing the gateway to a browser-reachable network. Judgment call: closest to pure config-surface parity of anything in this sweep; a reviewer could reasonably close this as out-of-scope given our config system differs structurally from etcd's flags. Filed for the decision. Note the third related knob — gateway response size — is N/A by construction: json.lua:653-699 dispatches in-process, with no internal gRPC client to cap. |
| design | |
| acceptance_criteria | OPTIONS preflight answered with Access-Control-* when a cors option is set; Host validated against a whitelist when configured; both default to today's behavior. |
| notes | |
| status | open |
| priority | 3 |
| issue_type | feature |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-07-17T13:22:00Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-07-17T13:22:00Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | <binary> |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| issue_id | tarantool-etcd-c7a |
| label | etcd-changelog-sweep |
| id | 019f703d-b444-7668-a794-783e75b85864 |
| issue_id | tarantool-etcd-c7a |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-07-17T16:21:59Z |
| id | 019f703d-b444-7e73-8e10-ffa9a904eccf |
| issue_id | tarantool-etcd-c7a |
| event_type | label_added |
| actor | Eugene Blikh |
| old_value | NULL |
| new_value | NULL |
| comment | Added label: etcd-changelog-sweep |
| created_at | 2026-07-17T16:21:59Z |
No comments.