diff --git a/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpService.java b/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpService.java index bcadf993d1..af50b53bb1 100644 --- a/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpService.java +++ b/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpService.java @@ -312,7 +312,8 @@ public class JsonRpcHttpService { router .route() .handler( - CorsHandler.create(buildCorsRegexFromConfig()) + CorsHandler.create() + .addRelativeOrigin(buildCorsRegexFromConfig()) .allowedHeader("*") .allowedHeader("content-type")); router @@ -569,7 +570,7 @@ public class JsonRpcHttpService { return ""; } if (config.getCorsAllowedDomains().contains("*")) { - return ".*://.*"; + return ".*://.*|.*"; } else { final StringJoiner stringJoiner = new StringJoiner("|"); config.getCorsAllowedDomains().stream().filter(s -> !s.isEmpty()).forEach(stringJoiner::add); diff --git a/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpServiceCorsTest.java b/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpServiceCorsTest.java index a875555af1..8ee1d33b79 100644 --- a/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpServiceCorsTest.java +++ b/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpServiceCorsTest.java @@ -166,6 +166,18 @@ public class JsonRpcHttpServiceCorsTest { } } + @Test + public void requestWithAnyOriginAndEmptyActualOriginShouldSucceed() throws Exception { + jsonRpcHttpService = createJsonRpcHttpServiceWithAllowedDomains("*"); + + final Request request = + new Request.Builder().url(jsonRpcHttpService.url()).header("Origin", "").build(); + + try (final Response response = client.newCall(request).execute()) { + assertThat(response.isSuccessful()).isTrue(); + } + } + @Test public void requestFromBrowserExtensionShouldSucceedWhenCorsIsStar() throws Exception { jsonRpcHttpService = createJsonRpcHttpServiceWithAllowedDomains("*");