Repository navigation
📝 Add deployment guidance for serving uploaded media safely - #67
Conversation
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Rendered on the preview:
Figure: the new page and its sidebar entry under Media Storage, live at https://docs-14gpgm53p-tinacms.vercel.app/docs/reference/media/serving-media-safely
Figure: the Next.js, Netlify, Vercel and nginx header examples, live at https://docs-14gpgm53p-tinacms.vercel.app/docs/reference/media/serving-media-safely |
joshbermanssw
left a comment
joshbermanssw
left a comment
There was a problem hiding this comment.
Header advice looks good. A few inline suggestions, the first one matters most.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
joshbermanssw
left a comment
joshbermanssw
left a comment
There was a problem hiding this comment.
All four threads addressed, and you were right about the adapters (s3/dos/cloudinary/azure all got the check in the same fix), thanks for the correction. One optional wording nit inline. LGTM.
Co-authored-by: Josh Berman [SSW] <137844305+joshbermanssw@users.noreply.github.com>
This branch was successfully deployed
2 participants
Pain: repo-based media is served from your site's own domain, so an uploaded file that a browser runs as a page or a script runs with your site's cookies. SVG can still carry script after upload, and nothing documented how to harden the way media is served against it.
Solution: adds a "Serving Uploaded Media Safely" page under Media Storage covering nosniff, a sandboxing CSP on the media path, and serving media from a separate origin, with Next.js, Netlify, Vercel and nginx header snippets. It documents the deployment-hardening acceptance criterion of tinacms/tinacloud#3818, and adds a link to the new page from Repo-based Media.