Commit e11dd4e

authored

fix: match Origin scheme if defined in OriginPatterns (#536)

This change aligns origin checks with RFC 6454 by adding scheme-aware matching to OriginPatterns. Fixes #529

1 parent 91013c1 commit e11dd4eCopy full SHA for e11dd4e

File tree

+45

-4

lines changed

+45

-4

lines changed

Lines changed: 9 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -40,9 +40,10 @@ type AcceptOptions struct {`
`40`	`40`	`// In such a case, example.com is the origin and chat.example.com is the request host.`
`41`	`41`	`// One would set this field to []string{"example.com"} to authorize example.com to connect.`
`42`	`42`	`//`
`43`		`- // Each pattern is matched case insensitively against the request origin host`
`44`		`- // with path.Match.`
`45`		`- // See https://golang.org/pkg/path/#Match`
	`43`	`+ // Each pattern is matched case insensitively with path.Match (see`
	`44`	`+ // https://golang.org/pkg/path/#Match). By default, it is matched`
	`45`	`+ // against the request origin host. If the pattern contains a URI`
	`46`	`+ // scheme ("://"), it will be matched against "scheme://host".`
`46`	`47`	`//`
`47`	`48`	`// Please ensure you understand the ramifications of enabling this.`
`48`	`49`	`// If used incorrectly your WebSocket server will be open to CSRF attacks.`
`@@ -240,7 +241,11 @@ func authenticateOrigin(r *http.Request, originHosts []string) error {`
`240`	`241`	`}`
`241`	`242`
`242`	`243`	`for _, hostPattern := range originHosts {`
`243`		`- matched, err := match(hostPattern, u.Host)`
	`244`	`+ target := u.Host`
	`245`	`+ if strings.Contains(hostPattern, "://") {`
	`246`	`+ target = u.Scheme + "://" + u.Host`
	`247`	`+ }`
	`248`	`+ matched, err := match(hostPattern, target)`
`244`	`249`	`if err != nil {`
`245`	`250`	`return fmt.Errorf("failed to parse path pattern %q: %w", hostPattern, err)`
`246`	`251`	`}`

Lines changed: 36 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -466,6 +466,42 @@ func Test_authenticateOrigin(t *testing.T) {`
`466`	`466`	`},`
`467`	`467`	`success: false,`
`468`	`468`	`},`
	`469`	`+ {`
	`470`	`+ name: "originPatternsWithSchemeHttps",`
	`471`	`+ origin: "https://two.example.com",`
	`472`	`+ host: "example.com",`
	`473`	`+ originPatterns: []string{`
	`474`	`+ "https://*.example.com",`
	`475`	`+ },`
	`476`	`+ success: true,`
	`477`	`+ },`
	`478`	`+ {`
	`479`	`+ name: "originPatternsWithSchemeMismatch",`
	`480`	`+ origin: "https://two.example.com",`
	`481`	`+ host: "example.com",`
	`482`	`+ originPatterns: []string{`
	`483`	`+ "http://*.example.com",`
	`484`	`+ },`
	`485`	`+ success: false,`
	`486`	`+ },`
	`487`	`+ {`
	`488`	`+ name: "originPatternsWithSchemeAndPort",`
	`489`	`+ origin: "https://example.com:8443",`
	`490`	`+ host: "example.com",`
	`491`	`+ originPatterns: []string{`
	`492`	`+ "https://example.com:8443",`
	`493`	`+ },`
	`494`	`+ success: true,`
	`495`	`+ },`
	`496`	`+ {`
	`497`	`+ name: "backwardsCompatHostOnlyPattern",`
	`498`	`+ origin: "http://two.example.com",`
	`499`	`+ host: "example.com",`
	`500`	`+ originPatterns: []string{`
	`501`	`+ "*.example.com",`
	`502`	`+ },`
	`503`	`+ success: true,`
	`504`	`+ },`
`469`	`505`	`}`
`470`	`506`
`471`	`507`	`for _, tc := range testCases {`

Comments

(0)