weichen
171959710d
Replace wildcard CORS with configured origins and bind chat/task user identity to the authenticated principal instead of request body fields.
28 lines
603 B
Go
28 lines
603 B
Go
package server
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
func applyCORSHeaders(w http.ResponseWriter, r *http.Request, allowedOrigins []string) {
|
|
origin := strings.TrimSpace(r.Header.Get("Origin"))
|
|
if origin == "" || len(allowedOrigins) == 0 {
|
|
return
|
|
}
|
|
for _, allowed := range allowedOrigins {
|
|
if strings.TrimSpace(allowed) == origin {
|
|
w.Header().Set("Access-Control-Allow-Origin", origin)
|
|
w.Header().Set("Vary", "Origin")
|
|
return
|
|
}
|
|
}
|
|
}
|
|
|
|
func (s *Server) writeCORS(w http.ResponseWriter, r *http.Request) {
|
|
if s.cfg == nil {
|
|
return
|
|
}
|
|
applyCORSHeaders(w, r, s.cfg.CORSAllowedOrigins)
|
|
}
|