amassivus/prometheus
1
0
Fork 0
mirror of https://github.com/prometheus/prometheus.git synced 2025-07-02 10:41:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 17

util/httputil: Always add Vary header in SetCORS

Browse source 
Closes #15406

Signed-off-by: jub0bs <jcretel-infosec+github@protonmail.com>
This commit is contained in:
jub0bs 2025-02-10 21:43:18 +01:00
parent eb8d34c2ad
commit 4bc8df0f54
No known key found for this signature in database
GPG key ID: 9BC102DCCA7031A9
2 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
util/httputil/cors.go
View file

@ -23,11 +23,11 @@ var corsHeaders = map[string]string{
"Access-Control-Allow-Headers": "Accept, Authorization, Content-Type, Origin",
"Access-Control-Allow-Methods": "GET, POST, OPTIONS",
"Access-Control-Expose-Headers": "Date",
"Vary": "Origin",
}
// SetCORS enables cross-site script calls.
// SetCORS enables cross-origin script calls.
func SetCORS(w http.ResponseWriter, o *regexp.Regexp, r *http.Request) {
w.Header().Add("Vary", "Origin")
origin := r.Header.Get("Origin")
if origin == "" {
return

20
util/httputil/cors_test.go
View file

@ -48,8 +48,10 @@ func TestCORSHandler(t *testing.T) {
resp, err := client.Do(req)
require.NoError(t, err, "client get failed with unexpected error")
AccessControlAllowOrigin := resp.Header.Get("Access-Control-Allow-Origin")
Vary := resp.Header.Get("Vary")
require.Equal(t, "Origin", Vary)
AccessControlAllowOrigin := resp.Header.Get("Access-Control-Allow-Origin")
require.Equal(t, dummyOrigin, AccessControlAllowOrigin, "expected Access-Control-Allow-Origin header")
// OPTIONS with bad origin
@ -62,4 +64,20 @@ func TestCORSHandler(t *testing.T) {
AccessControlAllowOrigin = resp.Header.Get("Access-Control-Allow-Origin")
require.Empty(t, AccessControlAllowOrigin, "Access-Control-Allow-Origin header should not exist but it was set")
Vary = resp.Header.Get("Vary")
require.Equal(t, "Origin", Vary)
// OPTIONS with no origin
req, err = http.NewRequest(http.MethodOptions, server.URL+"/any_path", nil)
require.NoError(t, err)
resp, err = client.Do(req)
require.NoError(t, err)
Vary = resp.Header.Get("Vary")
require.Equal(t, "Origin", Vary)
AccessControlAllowOrigin = resp.Header.Get("Access-Control-Allow-Origin")
require.Empty(t, AccessControlAllowOrigin)
}