diff --git a/accept.go b/accept.go index 0f3b0d16..cc990428 100644 --- a/accept.go +++ b/accept.go @@ -40,9 +40,10 @@ type AcceptOptions struct { // In such a case, example.com is the origin and chat.example.com is the request host. // One would set this field to []string{"example.com"} to authorize example.com to connect. // - // Each pattern is matched case insensitively against the request origin host - // with path.Match. - // See https://golang.org/pkg/path/#Match + // Each pattern is matched case insensitively with path.Match (see + // https://golang.org/pkg/path/#Match). By default, it is matched + // against the request origin host. If the pattern contains a URI + // scheme ("://"), it will be matched against "scheme://host". // // Please ensure you understand the ramifications of enabling this. // If used incorrectly your WebSocket server will be open to CSRF attacks. @@ -240,7 +241,11 @@ func authenticateOrigin(r *http.Request, originHosts []string) error { } for _, hostPattern := range originHosts { - matched, err := match(hostPattern, u.Host) + target := u.Host + if strings.Contains(hostPattern, "://") { + target = u.Scheme + "://" + u.Host + } + matched, err := match(hostPattern, target) if err != nil { return fmt.Errorf("failed to parse path pattern %q: %w", hostPattern, err) } diff --git a/accept_test.go b/accept_test.go index aeea1d8a..92dbfcc7 100644 --- a/accept_test.go +++ b/accept_test.go @@ -466,6 +466,42 @@ func Test_authenticateOrigin(t *testing.T) { }, success: false, }, + { + name: "originPatternsWithSchemeHttps", + origin: "https://two.example.com", + host: "example.com", + originPatterns: []string{ + "https://*.example.com", + }, + success: true, + }, + { + name: "originPatternsWithSchemeMismatch", + origin: "https://two.example.com", + host: "example.com", + originPatterns: []string{ + "http://*.example.com", + }, + success: false, + }, + { + name: "originPatternsWithSchemeAndPort", + origin: "https://example.com:8443", + host: "example.com", + originPatterns: []string{ + "https://example.com:8443", + }, + success: true, + }, + { + name: "backwardsCompatHostOnlyPattern", + origin: "http://two.example.com", + host: "example.com", + originPatterns: []string{ + "*.example.com", + }, + success: true, + }, } for _, tc := range testCases {