Skip to content

Commit

Permalink
Allow specifying redundant default port in origin
Browse files Browse the repository at this point in the history
When `http://EXAMPLE:80` is an allowed origin, requests are not allowed from
`http://EXAMPLE`. Since port 80 is the default port for HTTP, browsers
will strip it and thus rack-cors never receives a request from `http://EXAMPLE`.

A similar problem is discussed here: request/request#515
  • Loading branch information
nbr committed Apr 4, 2018
1 parent 4557f7d commit c983e70
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 2 deletions.
2 changes: 1 addition & 1 deletion lib/rack/cors.rb
Expand Up @@ -278,8 +278,8 @@ def origins(*args, &blk)
case n
when Proc,
Regexp,
/^https?:\/\//,
'file://' then n
when /^https?:\/\// then URI.parse(n).to_s
when '*' then @public_resources = true; n
else Regexp.compile("^[a-z][a-z0-9.+-]*:\\\/\\\/#{Regexp.quote(n)}$")
end
Expand Down
7 changes: 7 additions & 0 deletions test/unit/cors_test.rb
Expand Up @@ -270,6 +270,13 @@ def load_app(name)
cors_result.must_be :preflight
end

it 'should allow HTTP/HTTPS origin without the default port' do
preflight_request('http://allow-the-default-port.io', '/')
last_response.must_render_cors_success
preflight_request('https://allow-the-default-port.io', '/')
last_response.must_render_cors_success
end

it 'should allow any header if headers = :any' do
preflight_request('http://localhost:3000', '/', :headers => 'Fooey')
last_response.must_render_cors_success
Expand Down
4 changes: 3 additions & 1 deletion test/unit/test.ru
Expand Up @@ -8,7 +8,9 @@ use Rack::Cors do
'127.0.0.1:3000',
/http:\/\/192\.168\.0\.\d{1,3}(:\d+)?/,
'file://',
/http:\/\/(.*?)\.example\.com/
/http:\/\/(.*?)\.example\.com/,
'http://allow-the-default-port.io:80',
'https://allow-the-default-port.io:443'

resource '/get-only', :methods => :get
resource '/', :headers => :any, :methods => :any
Expand Down

0 comments on commit c983e70

Please sign in to comment.