mirror of
https://github.com/element-hq/matrix-authentication-service.git
synced 2026-08-15 00:19:49 +00:00
Quentin Gliech
efc98a48d2
Rather than one lowest-common-denominator policy, each kind of route gets the strictest policy it can bear: the server-rendered pages, the account SPA shell, the Swagger UI, and a locked-down catch-all for everything else. They are computed once at startup from the site configuration and the `UrlBuilder` — the captcha provider origins, the plan-management iframe origin and a possible cross-origin assets host are the only dynamic inputs — and stored as prebuilt `HeaderValue`s. The `form_post` authorization response is the one per-response case, as its `form-action` names the redirect URI of the grant being completed.