docs/content/configuration.md

@@ -86,7 +86,6 @@ these are rarely used for various reasons.
 | `protocolUseSSL` | `CMD_PROTOCOL_USESSL` | **`false`** or `true`                                                    | set to use SSL protocol for resources path (only applied when domain is set)                                      |
 | `useSSL`         |                       | **`false`** or `true`                                                    | set to use SSL server (if `true`, will auto turn on `protocolUseSSL`)                                             |
 | `urlAddPort`     | `CMD_URL_ADDPORT`     | **`false`** or `true`                                                    | set to add port on callback URL (ports `80` or `443` won't be applied) (only applied when domain is set)          |
-| `allowOrigin`    | `CMD_ALLOW_ORIGIN`    | **`['localhost']`**, `['hedgedoc.org']`, `['localhost', 'hedgedoc.org']` | domain name whitelist (use comma to separate)                                                                     |
 
 ## Web security aspects
 

lib/config/default.js

@@ -9,7 +9,6 @@ module.exports = {
   port: 3000,
   loglevel: 'info',
   urlAddPort: false,
-  allowOrigin: ['localhost'],
   useSSL: false,
   hsts: {
     enable: true,

lib/config/environment.js

@@ -31,7 +31,6 @@ module.exports = {
   rateLimitUsingCloudflare: toBooleanConfig(process.env.CMD_RATE_LIMIT_USING_CLOUDFLARE),
   cookiePolicy: process.env.CMD_COOKIE_POLICY,
   protocolUseSSL: toBooleanConfig(process.env.CMD_PROTOCOL_USESSL),
-  allowOrigin: toArrayConfig(process.env.CMD_ALLOW_ORIGIN),
   allowAnonymous: toBooleanConfig(process.env.CMD_ALLOW_ANONYMOUS),
   allowAnonymousEdits: toBooleanConfig(process.env.CMD_ALLOW_ANONYMOUS_EDITS),
   allowFreeURL: toBooleanConfig(process.env.CMD_ALLOW_FREEURL),

lib/config/hackmdEnvironment.js

@@ -19,7 +19,6 @@ module.exports = {
     reportURI: process.env.HMD_CSP_REPORTURI
   },
   protocolUseSSL: toBooleanConfig(process.env.HMD_PROTOCOL_USESSL),
-  allowOrigin: toArrayConfig(process.env.HMD_ALLOW_ORIGIN),
   allowAnonymous: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS),
   allowAnonymousEdits: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS_EDITS),
   allowFreeURL: toBooleanConfig(process.env.HMD_ALLOW_FREEURL),

public/docs/release-notes.md

@@ -10,9 +10,10 @@
 - Enabled `.webp` for file uploads (for all backends but `imgur`, since it does not support it)
 - Removed unnecessary entries in the XSS whitelist
 
-### Refactor
+### Refactoring / Clean-up
 
 - Removed the old Temp database object and related API endpoints. This was used by a very old way of migrating the history and is no longer needed.
+- Removed unused `allowOrigin` (environment variable `CMD_ALLOW_ORIGIN`) config option.
 
 ### Bugfixes