QuickandClaude Opus 4.8
9123cfb1f4
The shared WebSocket upgrader rejected handshakes unless the browser's Origin host exactly matched r.Host. Behind a TLS-terminating CDN/proxy that rewrites Host to the internal origin (carrying the public host in X-Forwarded-Host), this comparison always failed and every realtime socket 403'd at the handshake — playback control, events, watch-together rooms, and admin log streaming all share the upgrader. checkWebSocketOrigin now also accepts an Origin matching X-Forwarded-Host, keeping the same-origin CSRF guard intact while supporting proxied deployments. Extract a shared forwardedHost helper (first hop of a multi-proxy list) and reuse it from requestBaseURL, replacing the duplicated inline parse. Also reject opaque (empty-host) origins explicitly. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
89 lines
2.2 KiB
Go
89 lines
2.2 KiB
Go
package handlers
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
func TestCheckWebSocketOrigin(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
host string
|
|
origin string
|
|
forwardedHost string
|
|
want bool
|
|
}{
|
|
{
|
|
name: "missing origin is allowed for non-browser clients",
|
|
host: "origin.internal:8097",
|
|
origin: "",
|
|
want: true,
|
|
},
|
|
{
|
|
name: "same origin matches host directly",
|
|
host: "silo.example.com",
|
|
origin: "https://silo.example.com",
|
|
want: true,
|
|
},
|
|
{
|
|
name: "foreign origin without a proxy is rejected",
|
|
host: "silo.example.com",
|
|
origin: "https://evil.example.com",
|
|
want: false,
|
|
},
|
|
{
|
|
// The CDN regression: it rewrites Host to the internal origin and
|
|
// carries the public host in X-Forwarded-Host.
|
|
name: "cdn-rewritten host accepts the forwarded public origin",
|
|
host: "origin.internal:8097",
|
|
origin: "https://silo.example.test",
|
|
forwardedHost: "silo.example.test",
|
|
want: true,
|
|
},
|
|
{
|
|
name: "foreign origin is rejected even with a forwarded host",
|
|
host: "origin.internal:8097",
|
|
origin: "https://evil.example.com",
|
|
forwardedHost: "silo.example.test",
|
|
want: false,
|
|
},
|
|
{
|
|
name: "first hop of a multi-proxy forwarded host is honored",
|
|
host: "origin.internal:8097",
|
|
origin: "https://silo.example.test",
|
|
forwardedHost: "silo.example.test, edge.internal",
|
|
want: true,
|
|
},
|
|
{
|
|
name: "opaque null origin is rejected",
|
|
host: "silo.example.com",
|
|
origin: "null",
|
|
want: false,
|
|
},
|
|
{
|
|
name: "unparseable origin is rejected",
|
|
host: "silo.example.com",
|
|
origin: "https://silo.example.com\x7f",
|
|
want: false,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
req := httptest.NewRequest(http.MethodGet, "/playback/sessions/abc/control/ws", nil)
|
|
req.Host = tt.host
|
|
if tt.origin != "" {
|
|
req.Header.Set("Origin", tt.origin)
|
|
}
|
|
if tt.forwardedHost != "" {
|
|
req.Header.Set("X-Forwarded-Host", tt.forwardedHost)
|
|
}
|
|
|
|
if got := checkWebSocketOrigin(req); got != tt.want {
|
|
t.Fatalf("checkWebSocketOrigin() = %v, want %v", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|