Serve user content from a separate origin (USERCONTENT_ORIGIN)

Raw files, archives, release assets, attachments, avatars and camo-proxied images
are served only from a dedicated origin that never receives the forge session
cookie, like githubusercontent.com. Browser reads on the forge origin 302 there
with a 15-minute HMAC grant bound to the path and viewer so private content keeps
working; token clients are served in place because redirects drop credentials.
The user-content host serves nothing else and hardens every response (nosniff,
sandbox CSP, no-referrer, CORP, no Set-Cookie). Markdown emits camo URLs on the
content origin directly and the page CSP img-src allows it. Local dev maps
localhost to usercontent.localhost as the editor does.

taigrrcommitted 9 days agoparent 5e9039a9a2f2a1819bc91a1174c2be6d34ff5ad47968f64Browse files