diff options
Diffstat (limited to 'packaging/conf')
| -rw-r--r-- | packaging/conf/hub.toml.example | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/packaging/conf/hub.toml.example b/packaging/conf/hub.toml.example index d647707..7f5ac8f 100644 --- a/packaging/conf/hub.toml.example +++ b/packaging/conf/hub.toml.example @@ -66,8 +66,18 @@ secret_key = "" # and is served from `app://meshbay`, so the hostname Google sees is not this # hub's and never can be; with the console check on, the widget shows # "Invalid domain for site key" and nothing client-side reaches that decision. -# Add the client's own host only if you distribute it — it is the weak entry, -# since any Electron application can claim the same scheme and host. # -# allowed_hosts = ["hub.example.org", "localhost", "meshbay"] +# allowed_hosts = ["hub.example.org", "localhost"] allowed_hosts = [] + +# A solve Google cannot attribute to a domain reports an *empty* hostname — +# the desktop client's `app://` origin does, and so does any other non-web +# client. No `allowed_hosts` entry matches that, hence a flag rather than a +# blank list entry. +# +# What it admits is every non-web client, not only this project's: a file:// +# page or somebody else's Electron application look identical from here. The +# captcha still has to be solved per token; what is given up is the origin +# restriction for those clients. Leave it off unless you ship the desktop +# client. See docs/captcha.md §6. +allow_unattributed_host = false |