resolveUrl security concerns

[ntkoopman]

resolveUrl security concerns

[adamdbradley]

I think you're correct and tried to reflect it in the docs: https://github.com/BuilderIO/partytown/wiki/Proxying-Requests

Do you have a recommendation on how to best describe this?

[cihadhoruzoglu]

Maybe you can add extra domain check step in your server like whitelist domains array

[adamdbradley]

The docs recommend to use another domain.

[ntkoopman]

Sorry for not replying earlier. I think the updated docs explain it well enough. It's also possible to use a dummy content type if you really don't want anybody executing it as a script.

[linuxd3v]

I think the updated docs explain it well enough. It's also possible to use a dummy content type if you really don't want anybody executing it as a script.

even with using different domain - this reverse proxy is essentially "open proxy" - is it not? the way I read it - anyone could proxy any url through it - unless there is a detail i'm missing?

[ntkoopman]

I don't think you are missing anything. You can limit the scope by only allowing *.js, or use an explicit allowlist and only proxy dependencies that actually need this workaround.