@webjsdev/core 0.7.23 → 0.7.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/src/webjs-config.d.ts +10 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@webjsdev/core",
3
- "version": "0.7.23",
3
+ "version": "0.7.24",
4
4
  "type": "module",
5
5
  "description": "webjs core runtime - html/css tags, WebComponent base, isomorphic renderers",
6
6
  "types": "./index.d.ts",
package/src/webjs-config.d.ts CHANGED
@@ -188,6 +188,16 @@ export interface WebjsConfig {
188
188
  */
189
189
  basePath?: string;
190
190
 
191
+ /**
192
+ * Cross-origin hosts (or full origins) the action CSRF check accepts even
193
+ * when the request is cross-site. The action endpoint defends against CSRF
194
+ * with a `Sec-Fetch-Site` check plus an `Origin`-vs-host fallback; list any
195
+ * additional origins a reverse-proxy / multi-domain setup must allow here,
196
+ * e.g. `['admin.example.com', 'https://studio.example.com']`. A bare host or
197
+ * a full origin are both accepted. Default `[]` (same-origin only).
198
+ */
199
+ allowedOrigins?: string[];
200
+
191
201
  /**
192
202
  * Content-Security-Policy config. Off by default. `true` enables a
193
203
  * strict nonce-based default policy. An object customizes directives