mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 14:00:37 +00:00
60e8bf134a
Add an optional PENPOT_TRUSTED_ORIGINS setting listing alternate origins. When a request Origin matches, the backend uses it as the public base for links generated while serving that request: email links, asset URLs, audit and webhook link fields, and redirects. A global http middleware stamps the trusted origin on the request and binds the config public-uri to it for the request extent. OIDC authorization stores the origin in the signed state so the callback (a navigation without Origin) can rebuild the token-exchange redirect_uri and its redirect targets on the alternate domain. Unlisted origins and requests without Origin are unchanged. Only bare origins are supported, and server-to-server or queued work keeps the canonical public-uri. Closes #11625 AI-assisted-by: deepseek-v4.1-flash
Penpot Docs
Penpot documentation website.
Usage
To view this site locally, first set up the environment:
# only if necessary
nvm install
nvm use
pnpm install
And launch a development server:
pnpm start
You can then point a browser to http://localhost:8080.
Tooling
- Eleventy (11ty)
- Diagrams with plantuml. See also real-world-plantuml.
- Diagrams with svgbob and mermaid.
- arc42 template.
- c4model for software architecture, and an implementation in plantuml.