Hawkin
/
arangodb
mirror of https://gitee.com/bigwinds/arangodb
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

issue #2149, issue #2159 

do not overwrite CORS response headers set by Foxx application with hard-coded default values
This commit is contained in:
Jan Steemann 2016-11-09 08:25:45 +01:00
parent 5b054a7db7
commit b0119bb652
2 changed files with 30 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
arangod/GeneralServer/HttpCommTask.cpp
View File

@ -113,15 +113,18 @@ void HttpCommTask::addResponse(HttpResponse* response) {
// access-control-allow-origin header now // access-control-allow-origin header now
LOG(TRACE) << "handling CORS response"; LOG(TRACE) << "handling CORS response";
response->setHeaderNC(StaticStrings::AccessControlExposeHeaders,
StaticStrings::ExposedCorsHeaders);
// send back original value of "Origin" header // send back original value of "Origin" header
response->setHeaderNC(StaticStrings::AccessControlAllowOrigin, _origin); response->setHeaderNCIfNotSet(StaticStrings::AccessControlAllowOrigin, _origin);
// send back "Access-Control-Allow-Credentials" header // send back "Access-Control-Allow-Credentials" header
response->setHeaderNC(StaticStrings::AccessControlAllowCredentials, response->setHeaderNCIfNotSet(StaticStrings::AccessControlAllowCredentials,
(_denyCredentials ? "false" : "true")); (_denyCredentials ? "false" : "true"));
// use "IfNotSet" here because we should not override HTTP headers set
// by Foxx applications
response->setHeaderNCIfNotSet(StaticStrings::AccessControlExposeHeaders,
StaticStrings::ExposedCorsHeaders);
} }
// set "connection" header, keep-alive is the default // set "connection" header, keep-alive is the default
@ -650,7 +653,7 @@ bool HttpCommTask::checkContentLength(HttpRequest* request,
void HttpCommTask::processCorsOptions(std::unique_ptr<HttpRequest> request) { void HttpCommTask::processCorsOptions(std::unique_ptr<HttpRequest> request) {
HttpResponse response(rest::ResponseCode::OK); HttpResponse response(rest::ResponseCode::OK);
response.setHeaderNC(StaticStrings::Allow, StaticStrings::CorsMethods); response.setHeaderNCIfNotSet(StaticStrings::Allow, StaticStrings::CorsMethods);
if (!_origin.empty()) { if (!_origin.empty()) {
LOG(TRACE) << "got CORS preflight request"; LOG(TRACE) << "got CORS preflight request";
@ -659,17 +662,15 @@ void HttpCommTask::processCorsOptions(std::unique_ptr<HttpRequest> request) {
// send back which HTTP methods are allowed for the resource // send back which HTTP methods are allowed for the resource
// we'll allow all // we'll allow all
response.setHeaderNC(StaticStrings::AccessControlAllowMethods, response.setHeaderNCIfNotSet(StaticStrings::AccessControlAllowMethods,
StaticStrings::CorsMethods); StaticStrings::CorsMethods);
if (!allowHeaders.empty()) { if (!allowHeaders.empty()) {
// allow all extra headers the client requested // allow all extra headers the client requested
// we don't verify them here. the worst that can happen is that the // we don't verify them here. the worst that can happen is that the
// client // client sends some broken headers and then later cannot access the data on
// sends some broken headers and then later cannot access the data on // the server. that's a client problem.
// the response.setHeaderNCIfNotSet(StaticStrings::AccessControlAllowHeaders,
// server. that's a client problem.
response.setHeaderNC(StaticStrings::AccessControlAllowHeaders,
allowHeaders); allowHeaders);
LOG(TRACE) << "client requested validation of the following headers: " LOG(TRACE) << "client requested validation of the following headers: "
@ -677,7 +678,7 @@ void HttpCommTask::processCorsOptions(std::unique_ptr<HttpRequest> request) {
} }
// set caching time (hard-coded value) // set caching time (hard-coded value)
response.setHeaderNC(StaticStrings::AccessControlMaxAge, response.setHeaderNCIfNotSet(StaticStrings::AccessControlMaxAge,
StaticStrings::N1800); StaticStrings::N1800);
} }

9
lib/Rest/GeneralResponse.h
View File

@ -122,6 +122,15 @@ class GeneralResponse {
_headers[key] = std::move(value); _headers[key] = std::move(value);
} }
// adds a header if not set. the header field name must be lower-cased
void setHeaderNCIfNotSet(std::string const& key, std::string const& value) {
if (_headers.find(key) != _headers.end()) {
// already set
return;
}
_headers.emplace(key, value);
}
public: public:
virtual uint64_t messageId() const { return 1; } virtual uint64_t messageId() const { return 1; }