tauri-apps/plugins-workspace http-v2.7.0

http v2.7.0

on GitHub

[2.7.0]

• 1198a524 Security: Added the scopeRedirects plugin configuration option, which checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend. Without it, a server on an allowed origin can redirect the request to any other origin - including localhost services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview.

  {
    "plugins": {
      "http": {
        "scopeRedirects": true
      }
    }
  }

  It is opt-in because a redirect to a URL that is not allowed by the scope now fails with url not allowed on the configured scope instead of being followed, so applications that rely on being redirected outside of their scope must add the redirect target to the scope. This will become the default in v3.

  Note that tauri_plugin_http::init() now returns TauriPlugin<R, Option<Config>> instead of TauriPlugin<R>.

Updating crates.io index
    Updating crates.io index
   Packaging tauri-plugin-http v2.7.0 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/http)
    Updating crates.io index
    Packaged 26 files, 221.5KiB (57.9KiB compressed)
   Uploading tauri-plugin-http v2.7.0 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/http)
    Uploaded tauri-plugin-http v2.7.0 to registry `crates-io`
note: waiting for tauri-plugin-http v2.7.0 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
   Published tauri-plugin-http v2.7.0 at registry `crates-io`