Skip to content

Commit 2f70d3e

Browse files
vishrvishr
committed
fixed #712
Signed-off-by: Vishal Rana <vr@labstack.com>
1 parent 74ccda6 commit 2f70d3e

File tree

3 files changed

+62
-53
lines changed

3 files changed

+62
-53
lines changed

‎middleware/cors.go

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@ type (
1515
Skipper Skipper
1616

1717
// AllowOrigin defines a list of origins that may access the resource.
18-
// Optional. Default value []string{"*"}.
18+
// Optional. If request header `Origin` is set, value is []string{"<Origin>"}
19+
// else []string{"*"}.
1920
AllowOrigins []string `json:"allow_origins"`
2021

2122
// AllowMethods defines a list methods allowed when accessing the resource.
@@ -51,7 +52,6 @@ var (
5152
// DefaultCORSConfig is the default CORS middleware config.
5253
DefaultCORSConfig = CORSConfig{
5354
Skipper: defaultSkipper,
54-
AllowOrigins: []string{"*"},
5555
AllowMethods: []string{echo.GET, echo.HEAD, echo.PUT, echo.PATCH, echo.POST, echo.DELETE},
5656
}
5757
)
@@ -69,12 +69,10 @@ func CORSWithConfig(config CORSConfig) echo.MiddlewareFunc {
6969
if config.Skipper == nil {
7070
config.Skipper = DefaultCORSConfig.Skipper
7171
}
72-
if len(config.AllowOrigins) == 0 {
73-
config.AllowOrigins = DefaultCORSConfig.AllowOrigins
74-
}
7572
if len(config.AllowMethods) == 0 {
7673
config.AllowMethods = DefaultCORSConfig.AllowMethods
7774
}
75+
7876
allowedOrigins := strings.Join(config.AllowOrigins, ",")
7977
allowMethods := strings.Join(config.AllowMethods, ",")
8078
allowHeaders := strings.Join(config.AllowHeaders, ",")
@@ -89,6 +87,17 @@ func CORSWithConfig(config CORSConfig) echo.MiddlewareFunc {
8987

9088
req := c.Request()
9189
res := c.Response()
90+
origin := req.Header.Get(echo.HeaderOrigin)
91+
92+
if allowedOrigins == "" {
93+
if origin != "" {
94+
allowedOrigins = origin
95+
} else {
96+
if !config.AllowCredentials {
97+
allowedOrigins = "*"
98+
}
99+
}
100+
}
92101

93102
// Simple request
94103
if req.Method != echo.OPTIONS {

‎middleware/cors_test.go

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -11,21 +11,21 @@ import (
1111

1212
func TestCORS(t *testing.T) {
1313
e := echo.New()
14+
15+
// Origin origin
1416
req, _ := http.NewRequest(echo.GET, "/", nil)
1517
rec := httptest.NewRecorder()
1618
c := e.NewContext(req, rec)
17-
cors := CORSWithConfig(CORSConfig{
18-
AllowCredentials: true,
19-
})
20-
h := cors(func(c echo.Context) error {
21-
return c.String(http.StatusOK, "test")
22-
})
19+
h := CORS()(echo.NotFoundHandler)
20+
req.Header.Set(echo.HeaderOrigin, "localhost")
21+
h(c)
22+
assert.Equal(t, "localhost", rec.Header().Get(echo.HeaderAccessControlAllowOrigin))
2323

2424
// Wildcard origin
2525
req, _ = http.NewRequest(echo.GET, "/", nil)
2626
rec = httptest.NewRecorder()
2727
c = e.NewContext(req, rec)
28-
req.Header.Set(echo.HeaderOrigin, "localhost")
28+
h = CORS()(echo.NotFoundHandler)
2929
h(c)
3030
assert.Equal(t, "*", rec.Header().Get(echo.HeaderAccessControlAllowOrigin))
3131

@@ -34,14 +34,7 @@ func TestCORS(t *testing.T) {
3434
rec = httptest.NewRecorder()
3535
c = e.NewContext(req, rec)
3636
req.Header.Set(echo.HeaderOrigin, "localhost")
37-
cors = CORSWithConfig(CORSConfig{
38-
AllowOrigins: []string{"localhost"},
39-
AllowCredentials: true,
40-
MaxAge: 3600,
41-
})
42-
h = cors(func(c echo.Context) error {
43-
return c.String(http.StatusOK, "test")
44-
})
37+
h = CORS()(echo.NotFoundHandler)
4538
h(c)
4639
assert.Equal(t, "localhost", rec.Header().Get(echo.HeaderAccessControlAllowOrigin))
4740

@@ -51,6 +44,12 @@ func TestCORS(t *testing.T) {
5144
c = e.NewContext(req, rec)
5245
req.Header.Set(echo.HeaderOrigin, "localhost")
5346
req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
47+
cors := CORSWithConfig(CORSConfig{
48+
AllowOrigins: []string{"localhost"},
49+
AllowCredentials: true,
50+
MaxAge: 3600,
51+
})
52+
h = cors(echo.NotFoundHandler)
5453
h(c)
5554
assert.Equal(t, "localhost", rec.Header().Get(echo.HeaderAccessControlAllowOrigin))
5655
assert.NotEmpty(t, rec.Header().Get(echo.HeaderAccessControlAllowMethods))

‎website/content/middleware/cors.md

Lines changed: 34 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -33,39 +33,40 @@ e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
3333

3434
```go
3535
CORSConfig struct {
36-
// Skipper defines a function to skip middleware.
37-
Skipper Skipper
38-
39-
// AllowOrigin defines a list of origins that may access the resource.
40-
// Optional. Default value []string{"*"}.
41-
AllowOrigins []string `json:"allow_origins"`
42-
43-
// AllowMethods defines a list methods allowed when accessing the resource.
44-
// This is used in response to a preflight request.
45-
// Optional. Default value DefaultCORSConfig.AllowMethods.
46-
AllowMethods []string `json:"allow_methods"`
47-
48-
// AllowHeaders defines a list of request headers that can be used when
49-
// making the actual request. This in response to a preflight request.
50-
// Optional. Default value []string{}.
51-
AllowHeaders []string `json:"allow_headers"`
52-
53-
// AllowCredentials indicates whether or not the response to the request
54-
// can be exposed when the credentials flag is true. When used as part of
55-
// a response to a preflight request, this indicates whether or not the
56-
// actual request can be made using credentials.
57-
// Optional. Default value false.
58-
AllowCredentials bool `json:"allow_credentials"`
59-
60-
// ExposeHeaders defines a whitelist headers that clients are allowed to
61-
// access.
62-
// Optional. Default value []string{}.
63-
ExposeHeaders []string `json:"expose_headers"`
64-
65-
// MaxAge indicates how long (in seconds) the results of a preflight request
66-
// can be cached.
67-
// Optional. Default value 0.
68-
MaxAge int `json:"max_age"`
36+
// Skipper defines a function to skip middleware.
37+
Skipper Skipper
38+
39+
// AllowOrigin defines a list of origins that may access the resource.
40+
// Optional. If request header `Origin` is set, value is []string{"<Origin>"}
41+
// else []string{"*"}.
42+
AllowOrigins []string `json:"allow_origins"`
43+
44+
// AllowMethods defines a list methods allowed when accessing the resource.
45+
// This is used in response to a preflight request.
46+
// Optional. Default value DefaultCORSConfig.AllowMethods.
47+
AllowMethods []string `json:"allow_methods"`
48+
49+
// AllowHeaders defines a list of request headers that can be used when
50+
// making the actual request. This in response to a preflight request.
51+
// Optional. Default value []string{}.
52+
AllowHeaders []string `json:"allow_headers"`
53+
54+
// AllowCredentials indicates whether or not the response to the request
55+
// can be exposed when the credentials flag is true. When used as part of
56+
// a response to a preflight request, this indicates whether or not the
57+
// actual request can be made using credentials.
58+
// Optional. Default value false.
59+
AllowCredentials bool `json:"allow_credentials"`
60+
61+
// ExposeHeaders defines a whitelist headers that clients are allowed to
62+
// access.
63+
// Optional. Default value []string{}.
64+
ExposeHeaders []string `json:"expose_headers"`
65+
66+
// MaxAge indicates how long (in seconds) the results of a preflight request
67+
// can be cached.
68+
// Optional. Default value 0.
69+
MaxAge int `json:"max_age"`
6970
}
7071
```
7172

0 commit comments

Comments
 (0)