Matthew Draper dae4044734 Permit same-origin connections by default ... WebSocket always defers the decision to the server, because it didn't have to deal with legacy compatibility... but the same-origin policy is still a reasonable default. Origin checks do not protect against a directly connecting attacker -- they can lie about their host, but can also lie about their origin. Origin checks protect against a connection from 3rd-party controlled script in a context where a victim browser's cookies will be passed along. And if an attacker has breached that protection, they've already compromised the HTTP session, so treating the WebSocket connection in the same way seems reasonable. In case this logic proves incorrect (or anyone just wants to be more paranoid), we retain a config option to disable it.		2016-10-11 12:51:10 +10:30
..
worker	Use AS::Executor / AS::Reloader to support reloading in ActionCable	2016-03-02 02:14:20 +10:30
base.rb	Move behavior to Server::Base, and flush pubsub	2016-10-02 08:45:38 -04:00
broadcasting.rb	Add ActiveSupport::Notifications hook to Broadcaster#broadcast	2016-05-12 10:56:35 -07:00
configuration.rb	Permit same-origin connections by default	2016-10-11 12:51:10 +10:30
connections.rb	Support faye-websocket + EventMachine as an option	2016-03-02 12:17:15 +10:30
worker.rb	Shut down the worker pool - don't kill it	2016-10-03 05:38:25 +10:30