Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Allow same-origin WebSocket/SockJS requests once origin is set

Browse Source 
Issue: SPR-13464
This commit is contained in:
Sebastien Deleuze
2015-09-21 16:45:27 +02:00
parent f60bd25666
commit 299b7766fe
5 changed files with 38 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-websocket/src/main/java/org/springframework/web/socket/server/support/OriginHandshakeInterceptor.java
View File

@@ -93,7 +93,7 @@ public class OriginHandshakeInterceptor implements HandshakeInterceptor {
@Override
public boolean beforeHandshake(ServerHttpRequest request, ServerHttpResponse response,
WebSocketHandler wsHandler, Map<String, Object> attributes) throws Exception {
if (!WebUtils.isValidOrigin(request, this.allowedOrigins)) {
if (!WebUtils.isSameOrigin(request) && !WebUtils.isValidOrigin(request, this.allowedOrigins)) {
response.setStatusCode(HttpStatus.FORBIDDEN);
if (logger.isDebugEnabled()) {
logger.debug("Handshake request rejected, Origin header value "

5
spring-websocket/src/main/java/org/springframework/web/socket/sockjs/support/AbstractSockJsService.java
View File

@@ -448,13 +448,12 @@ public abstract class AbstractSockJsService implements SockJsService, CorsConfig
protected boolean checkOrigin(ServerHttpRequest request, ServerHttpResponse response,
HttpMethod... httpMethods) throws IOException {
String origin = request.getHeaders().getOrigin();
if (origin == null) {
if (WebUtils.isSameOrigin(request)) {
return true;
}
if (!WebUtils.isValidOrigin(request, this.allowedOrigins)) {
String origin = request.getHeaders().getOrigin();
logger.debug("Request rejected, Origin header value " + origin + " not allowed");
response.setStatusCode(HttpStatus.FORBIDDEN);
return false;