etherpad-lite/src/node
muxator a51684b022 security: stop setting the "io" cookie
The "io" cookie is created by socket.io, and its purpose is to offer an handle
to perform load balancing with session stickiness when the library falls back to
long polling or below.

In Etherpad's case, if an operator needs to load balance, he can use the
"express_sid" cookie, and thus "io" is of no use.

Moreover, socket.io API does not offer a way of setting the "secure" flag on it,
and thus is a liability.

Let's simply nuke it.

References:
  https://socket.io/docs/using-multiple-nodes/#Sticky-load-balancing
  https://github.com/socketio/socket.io/issues/2276#issuecomment-147184662 (not totally true, actually, see above)
2019-12-07 04:20:12 +01:00
..
db formatting: bulk remove trailing whitespaces 2019-10-20 02:09:22 +02:00
eejs use latest ejs 2015-04-11 09:53:27 +01:00
handler handler/PadMessageHandler.js: handleMessage() got the wrong padId for read only pads 2019-03-27 18:29:12 +01:00
hooks security: stop setting the "io" cookie 2019-12-07 04:20:12 +01:00
utils referer: change referrer policy. Stop sending referers as much as possible 2019-11-25 00:05:40 +01:00
easysync_tests.js Revert "51c14d9947 changed the return value of" 2015-02-16 06:22:49 +01:00
padaccess.js access controls: promisification 2019-01-23 16:29:36 +00:00
README.md minor typo fix 2019-08-08 21:58:30 +02:00
server.js runtime: deprecate node 8.x. Require node >= 10.13.0 starting from Etherpad 1.8.3 2019-10-20 00:02:00 +02:00
stats.js node8: we no longer need to use a shim for Object.values in stats.js 2019-02-19 22:01:12 +01:00

About the folder structure

  • db - all modules that are accessing the data structure and are communicating directly to the database
  • handler - all modules that respond directly to requests/messages of the browser
  • utils - helper modules

Module name conventions

Module file names start with a capital letter and uses camelCase

Where does it start?

server.js is started directly