Vapor 4.106.1 released!

[NewsBot]

Vapor 4.106.1 has been released.

What’s Changed

Omit ACAO header instead of empty value by @grahamburgsma in #3243

For context, Vapor currently sends an empty Access-Control-Allow-Origin (ACAO) header when the origin does not match or is set to none.

We recently had a pentest done against our Vapor server and the tester reported the following regarding the empty ACAO header:

When the header is empty, browsers might reject the request without detailed error messages, making it harder for developers to debug or even realize there is a problem. This lack of transparency can lead to extended periods of vulnerability before the issue is discovered.

Looking at some other sources as well, an empty header doesn’t appear to be a valid value and so could result in unexpected behaviour.

Cross-Origin Resource Sharing (CORS) - HTTP | MDN
Fetch Standard

This patch was released by @0xTim

Full Changelog:…

Link: Release 4.106.1 - Omit ACAO header instead of empty value · vapor/vapor · GitHub