http2-allow-cross-origin-push #1801
Conversation
This toggle allows H2O to push resources even if the authority doesn't match the one in the pushed stream. It's up to the administrator to determine whether this is a safe setting or not.
kazuho
left a comment
There was a problem hiding this comment.
Thank you for the PR. I think that this is a nice extension to H2O.
The only thing I wonder is if this needs to be a host-level configuration. While I do not have a strong preference on at which level it should be, I do not see why it is defined as a host-level thing.
It seems to me that it would be more natural to have the directive defined at path-level, considering the fact that what level of protection we'd want depends on the application running behind H2O, and that those application are bound by the path-level configuration directives (e.g. fastcgi.connect, proxy.reverse.url).
| #define h2o__uv_binding_h | ||
|
|
||
| #include <uv.h> | ||
| #include <sys/time.h> |
There was a problem hiding this comment.
It is, but it's intentional, my system gets warnings because gettimeofday below isn't defined. I'm happy to submit the fix as a separate PR, if you prefer.
That makes sense, thanks for the suggestion. Fixed in 22ece12 |
|
Thank you for the changes. Merged to master. |
This toggle allows H2O to push resources even if the authority doesn't
match the one in the pushed stream. It's up to the administrator to
determine whether this is a safe setting or not.