Fix "CORS Rejected - Invalid origin" issue when origin header is empty (#6988)

Signed-off-by: Ameziane H <ameziane.hamlat@consensys.net>
pull/7005/head
ahamlat 7 months ago committed by GitHub
parent 12723ace68
commit 27a7de90c4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
  1. 5
      ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpService.java
  2. 12
      ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpServiceCorsTest.java

@ -312,7 +312,8 @@ public class JsonRpcHttpService {
router
.route()
.handler(
CorsHandler.create(buildCorsRegexFromConfig())
CorsHandler.create()
.addRelativeOrigin(buildCorsRegexFromConfig())
.allowedHeader("*")
.allowedHeader("content-type"));
router
@ -569,7 +570,7 @@ public class JsonRpcHttpService {
return "";
}
if (config.getCorsAllowedDomains().contains("*")) {
return ".*://.*";
return ".*://.*|.*";
} else {
final StringJoiner stringJoiner = new StringJoiner("|");
config.getCorsAllowedDomains().stream().filter(s -> !s.isEmpty()).forEach(stringJoiner::add);

@ -166,6 +166,18 @@ public class JsonRpcHttpServiceCorsTest {
}
}
@Test
public void requestWithAnyOriginAndEmptyActualOriginShouldSucceed() throws Exception {
jsonRpcHttpService = createJsonRpcHttpServiceWithAllowedDomains("*");
final Request request =
new Request.Builder().url(jsonRpcHttpService.url()).header("Origin", "").build();
try (final Response response = client.newCall(request).execute()) {
assertThat(response.isSuccessful()).isTrue();
}
}
@Test
public void requestFromBrowserExtensionShouldSucceedWhenCorsIsStar() throws Exception {
jsonRpcHttpService = createJsonRpcHttpServiceWithAllowedDomains("*");

Loading…
Cancel
Save