mirror/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2026-06-19 07:36:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(core): Change default value of the COOP header (#32377)

Browse Source
This commit is contained in:
RomanDavydchuk
2026-06-16 16:01:44 +03:00
committed by GitHub
parent b9e7729ad6
commit b94ff9b47a
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/@n8n/config/src/configs/security.config.ts
+2 -1
View File
@@ -55,7 +55,8 @@ export class SecurityConfig {
* Configuration for the `Cross-Origin-Opener-Policy` header.
*/
@Env('N8N_CROSS_ORIGIN_OPENER_POLICY', crossOriginOpenerPolicySchema)
crossOriginOpenerPolicy: z.infer<typeof crossOriginOpenerPolicySchema> = 'same-origin';
crossOriginOpenerPolicy: z.infer<typeof crossOriginOpenerPolicySchema> =
'same-origin-allow-popups';
/**
* Whether to disable HTML sandboxing for webhooks. The sandboxing mechanism uses CSP headers now,
packages/@n8n/config/test/config.test.ts
+4 -4
View File
@@ -425,7 +425,7 @@ describe('GlobalConfig', () => {
daysAbandonedWorkflow: 90,
contentSecurityPolicy: '{}',
contentSecurityPolicyReportOnly: false,
crossOriginOpenerPolicy: 'same-origin',
crossOriginOpenerPolicy: 'same-origin-allow-popups',
disableWebhookHtmlSandboxing: false,
disableFormHtmlSandboxing: false,
disableBareRepos: true,
@@ -756,11 +756,11 @@ describe('GlobalConfig', () => {
it('should validate crossOriginOpenerPolicy enum values', () => {
process.env = {
N8N_CROSS_ORIGIN_OPENER_POLICY: 'same-origin-allow-popups',
N8N_CROSS_ORIGIN_OPENER_POLICY: 'same-origin',
};
const globalConfig = Container.get(GlobalConfig);
expect(globalConfig.security.crossOriginOpenerPolicy).toEqual('same-origin-allow-popups');
expect(globalConfig.security.crossOriginOpenerPolicy).toEqual('same-origin');
});
it('should warn and fall back to default for invalid crossOriginOpenerPolicy', () => {
@@ -769,7 +769,7 @@ describe('GlobalConfig', () => {
};
const globalConfig = Container.get(GlobalConfig);
expect(globalConfig.security.crossOriginOpenerPolicy).toEqual('same-origin');
expect(globalConfig.security.crossOriginOpenerPolicy).toEqual('same-origin-allow-popups');
});
});