Skip to content

refactor: Remove crossOriginExtensionsHost feature flag

Enrique Alcántararequested to merge
remove-cross-origin-extensions-host-feature-flag into main

What does this MR do and why?

It removes the crossOriginExtensionsHost feature flag. As a result, the web ide always uses a separate origin to run extensions. I propose this change because I think we should not provide an option to run the Extensions Host in the same origin as the Web IDE. A deployment architecture where both components run in the same origin leads to severe security risks that we should discourage at every level of the development cycle.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

This change doesn't introduce user-facing changes.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

This change doesn't introduce behavioral changes.

Edited by Enrique Alcántara

Merge request reports