Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-01-20 22:42:53 -05:00
Code Issues Activity

Updated all Origin header checks to handle 'null' (#12246)

Browse source 
closes #12244

As per RFC 6454 the Origin header MUST be set to the string 'null' when
in a "privacy-sensitive" context. We were not handling this string and
this was causing errors. This commit updates all checks of the 'Origin'
header to treat the value 'null' as if the header was not present.

ref: https://tools.ietf.org/html/rfc6454#section-7.3
This commit is contained in:
Fabien 'egg' O'Carroll 2020-10-01 09:37:22 +01:00 • committed by GitHub
parent eb4933d27e
commit 244704156c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
core/server/services/auth/session/index.js
View file

@ -13,7 +13,7 @@ function getOriginOfRequest(req) {
const origin = req.get('origin');
const referrer = req.get('referrer') || urlUtils.getAdminUrl() || urlUtils.getSiteUrl();
if (!origin && !referrer) {
if (!origin && !referrer || origin === 'null') {
return null;
}

2
core/server/web/api/middleware/cors.js
View file

@ -68,7 +68,7 @@ function handleCORS(req, cb) {
const origin = req.get('origin');
// Request must have an Origin header
if (!origin) {
if (!origin || origin === 'null') {
return cb(null, DISABLE_CORS);
}

2
core/server/web/site/app.js
View file

@ -31,7 +31,7 @@ const corsOptionsDelegate = function corsOptionsDelegate(req, callback) {
credentials: true // required to allow admin-client to login to private sites
};
if (!origin) {
if (!origin || origin === 'null') {
return callback(null, corsOptions);
}