v2.0.1 - Fixing CORS 2.0 bugs

CORS Demonstrator

Bugfixes

• corsClientHost value was only passed when revealing the solution. Is now always included, so that it's available in the scenario and goal sections of the template.

2.0 CORS Rewrite

Features

CORS Demonstrator

• Now uses the .env to get hostnames for both the client and API portions.
• Client now points at the API host specified in the .env by default. Override has been moved to the new Settings page.
• Renaming of policy buttons on Home page to set clearer expectations.
• Regex/Pattern policy on Home is no longer intentionally flawed. It uses a dynamic pattern based the client hostname specified in the .env and allows subdomains of that host.
• Two exercises added to CORS demonstrator with student challenges related to incorrectly implemented origin validation regexes.
• Minor project-branding/look changes.
• .env can specify USE_TLS true or false, which affects the URLs used to access the API. This does not enable TLS on the listener, as its current incarnation is intended for use through a reverse proxy.

CSP Demonstrator

• Minor project-branding/look changes.

Original Buildout

Features

• CORS Demonstrator with 3 Pre-defined Policies
• CSP Demonstrator with 1 exercise for bypass