TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-06-18 09:38:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: CORS on assets api (#3659)

Browse Source
This commit is contained in:
Livio Amstutz 2022-05-19 16:09:02 +02:00 committed by GitHub
parent a5cea82670
commit 0906c2d513
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
internal/api/assets/asset.go
View File

@ -83,10 +83,10 @@ func NewHandler(commands *command.Commands, verifier *authz.TokenVerifier, authC
verifier.RegisterServer("Assets-API", "assets", AssetsService_AuthMethods) verifier.RegisterServer("Assets-API", "assets", AssetsService_AuthMethods)
router := mux.NewRouter() router := mux.NewRouter()
router.Use(sentryhttp.New(sentryhttp.Options{}).Handle, http_mw.CORSInterceptor, instanceInterceptor) router.Use(sentryhttp.New(sentryhttp.Options{}).Handle, instanceInterceptor)
RegisterRoutes(router, h) RegisterRoutes(router, h)
router.PathPrefix("/{owner}").Methods("GET").HandlerFunc(DownloadHandleFunc(h, h.GetFile())) router.PathPrefix("/{owner}").Methods("GET").HandlerFunc(DownloadHandleFunc(h, h.GetFile()))
return router return http_util.CopyHeadersToContext(http_mw.CORSInterceptor(router))
} }
func (h *Handler) GetFile() Downloader { func (h *Handler) GetFile() Downloader {

5
internal/api/authz/context.go
View File

@ -125,7 +125,10 @@ func GetAllPermissionsFromCtx(ctx context.Context) []string {
func checkOrigin(ctx context.Context, origins []string) error { func checkOrigin(ctx context.Context, origins []string) error {
origin := grpc.GetGatewayHeader(ctx, http_util.Origin) origin := grpc.GetGatewayHeader(ctx, http_util.Origin)
if origin == "" { if origin == "" {
return nil origin = http_util.OriginFromCtx(ctx)
if origin == "" {
return nil
}
} }
if http_util.IsOriginAllowed(origins, origin) { if http_util.IsOriginAllowed(origins, origin) {
return nil return nil

14
internal/api/http/header.go
View File

@ -40,9 +40,9 @@ const (
type key int type key int
var ( const (
httpHeaders key httpHeaders key = iota
remoteAddr key remoteAddr
) )
func CopyHeadersToContext(h http.Handler) http.Handler { func CopyHeadersToContext(h http.Handler) http.Handler {
@ -59,6 +59,14 @@ func HeadersFromCtx(ctx context.Context) (http.Header, bool) {
return headers, ok return headers, ok
} }
func OriginFromCtx(ctx context.Context) string {
headers, ok := ctx.Value(httpHeaders).(http.Header)
if !ok {
return ""
}
return headers.Get(Origin)
}
func RemoteIPFromCtx(ctx context.Context) string { func RemoteIPFromCtx(ctx context.Context) string {
ctxHeaders, ok := HeadersFromCtx(ctx) ctxHeaders, ok := HeadersFromCtx(ctx)
if !ok { if !ok {