Pharo browser Git traffic can pass through a CORS proxy
Original title: Pharo in the Browser with WebAssembly
Iceberg and Metacello requests, including push tokens, are visible to the proxy the user selects.
A Pharo virtual machine running in the browser sends Iceberg clone, fetch, pull and push operations and Metacello github:// loads through a configurable CORS proxy. The proxy receives repository code and any username and token supplied for a push. The page says to use only a proxy you run or trust, or None so requests go directly to a host that allows this page via CORS. The browser stores that choice, and a link cannot override it.
- Requests are sent to the proxy URL plus the repository host and path.
- Push credentials go through My proxy or straight to the host with None.
- None works only when the repository server permits this page via CORS.
Impact: Proxy can see repository code and push credentials
- 1.Use a CORS proxy you run or trust, or select None.
From the original article
1 min read at massimo-nocentini.github.ioIceberg's https:// clones, fetches, pulls and pushes, and Metacello's github:// loads, go to this CORS proxy: each request goes to the proxy's URL followed by the host and the path of the repository, such as github. com/pharo-project/pharo. git.
By xkriva11 · massimo-nocentini.github.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.