Repository navigation
Origin check should not only be a check against the host #529
Description
Activity
@timofurrer It seems
Hostcontains host and port https://pkg.go.dev/net/url#URL, but I think they may miss schema here. Based on this spec https://datatracker.ietf.org/doc/html/rfc6454#section-3.2, the schema is required.Thanks for raising this issue @timofurrer.
I believe the best way to amend this would be to detect the presence of URI scheme (
://) in the OriginPattern and if present, include it in the comparison. That way, we can allow more specificity without a breaking change. Thoughts?As @sc0Vu mentioned, the port is already included so we only need to add the scheme.
- added a commit that references this issue
on Sep 2, 2025 @timofurrer @sc0Vu I've implemented a fix in #536, although for backwards compatibility, there still exists one small gotcha: If the request host matches the origin host exactly, we always allow it.
We could change the behavior such that this only applies if no OriginPatterns have been defined, but that's a breaking change. So my question is, does #536 seem sufficient to close this issue?
- added a commit that references this issue
on Sep 3, 2025
The package supports to automatically perform an
Originheader check viaOriginPatterns. However, these origin patterns are only checked against theOriginheaderHostcomponent (seewebsocket/accept.go
Line 244 in efb626b
I believe that this is incorrect and the entire
Originheader should be checked against a set of allowed once - that is, including the schema and port.