Fix "CORS Rejected - Invalid origin" issue when origin header is empty (#6988)

Signed-off-by: Ameziane H <ameziane.hamlat@consensys.net>
pull/7005/head
ahamlat 7 months ago committed by GitHub
parent 12723ace68
commit 27a7de90c4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
  1. 5
      ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpService.java
  2. 12
      ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcHttpServiceCorsTest.java

@ -312,7 +312,8 @@ public class JsonRpcHttpService {
router router
.route() .route()
.handler( .handler(
CorsHandler.create(buildCorsRegexFromConfig()) CorsHandler.create()
.addRelativeOrigin(buildCorsRegexFromConfig())
.allowedHeader("*") .allowedHeader("*")
.allowedHeader("content-type")); .allowedHeader("content-type"));
router router
@ -569,7 +570,7 @@ public class JsonRpcHttpService {
return ""; return "";
} }
if (config.getCorsAllowedDomains().contains("*")) { if (config.getCorsAllowedDomains().contains("*")) {
return ".*://.*"; return ".*://.*|.*";
} else { } else {
final StringJoiner stringJoiner = new StringJoiner("|"); final StringJoiner stringJoiner = new StringJoiner("|");
config.getCorsAllowedDomains().stream().filter(s -> !s.isEmpty()).forEach(stringJoiner::add); config.getCorsAllowedDomains().stream().filter(s -> !s.isEmpty()).forEach(stringJoiner::add);

@ -166,6 +166,18 @@ public class JsonRpcHttpServiceCorsTest {
} }
} }
@Test
public void requestWithAnyOriginAndEmptyActualOriginShouldSucceed() throws Exception {
jsonRpcHttpService = createJsonRpcHttpServiceWithAllowedDomains("*");
final Request request =
new Request.Builder().url(jsonRpcHttpService.url()).header("Origin", "").build();
try (final Response response = client.newCall(request).execute()) {
assertThat(response.isSuccessful()).isTrue();
}
}
@Test @Test
public void requestFromBrowserExtensionShouldSucceedWhenCorsIsStar() throws Exception { public void requestFromBrowserExtensionShouldSucceedWhenCorsIsStar() throws Exception {
jsonRpcHttpService = createJsonRpcHttpServiceWithAllowedDomains("*"); jsonRpcHttpService = createJsonRpcHttpServiceWithAllowedDomains("*");

Loading…
Cancel
Save