TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-05-01 19:10:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: check http methods on specific http2 routes (#3527)

Browse Source 
* fix: check headers lowercase

* Update .releaserc.js

* fix: check http methods on specific http2 routes
This commit is contained in:
Livio Amstutz 2022-04-27 13:10:44 +02:00 committed by GitHub
parent ab04655019
commit fd1150f628
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 32 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
internal/api/api.go
View File

@ -83,12 +83,15 @@ func (a *API) RegisterHandler(prefix string, handler http.Handler) {
} }
func (a *API) routeGRPC() { func (a *API) routeGRPC() {
http2Route := a.router.Methods(http.MethodPost). http2Route := a.router.
MatcherFunc(func(r *http.Request, _ *mux.RouteMatch) bool { MatcherFunc(func(r *http.Request, _ *mux.RouteMatch) bool {
return r.ProtoMajor == 2 return r.ProtoMajor == 2
}). }).
Subrouter() Subrouter()
http2Route.Headers("Content-Type", "application/grpc").Handler(a.grpcServer) http2Route.
Methods(http.MethodPost).
Headers("Content-Type", "application/grpc").
Handler(a.grpcServer)
if !a.externalSecure { if !a.externalSecure {
a.routeGRPCWeb(a.router) a.routeGRPCWeb(a.router)
@ -98,13 +101,16 @@ func (a *API) routeGRPC() {
} }
func (a *API) routeGRPCWeb(router *mux.Router) { func (a *API) routeGRPCWeb(router *mux.Router) {
router.NewRoute().MatcherFunc( router.NewRoute().
Methods(http.MethodPost, http.MethodOptions).
MatcherFunc(
func(r *http.Request, _ *mux.RouteMatch) bool { func(r *http.Request, _ *mux.RouteMatch) bool {
if strings.Contains(r.Header.Get("content-type"), "application/grpc-web+") { if strings.Contains(strings.ToLower(r.Header.Get("content-type")), "application/grpc-web+") {
return true return true
} }
return strings.Contains(r.Header.Get("access-control-request-headers"), "x-grpc-web") return strings.Contains(strings.ToLower(r.Header.Get("access-control-request-headers")), "x-grpc-web")
}).Handler( }).
Handler(
grpcweb.WrapServer(a.grpcServer, grpcweb.WrapServer(a.grpcServer,
grpcweb.WithAllowedRequestHeaders( grpcweb.WithAllowedRequestHeaders(
[]string{ []string{