web/cors.py
author Julien Cristau <julien.cristau@logilab.fr>
Thu, 08 Jan 2015 12:20:36 +0100
changeset 10152 2ca571e4cb2f
parent 10002 586d0e527052
child 10588 fdaa0e4b7eaf
permissions -rw-r--r--
[pkg] 3.20.2
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
9571
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
     1
# -*- coding: utf-8 -*-
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
     2
# copyright 2014 Logilab, PARIS
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
     3
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
     4
"""A set of utility functions to handle CORS requests
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
     5
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
     6
Unless specified, all references in this file are related to:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
     7
  http://www.w3.org/TR/cors
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
     8
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
     9
The provided implementation roughly follows:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    10
  http://www.html5rocks.com/static/images/cors_server_flowchart.png
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    11
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    12
See also:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    13
  https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    14
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    15
"""
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    16
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    17
import urlparse
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    18
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    19
from cubicweb.web import LOGGER
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    20
info = LOGGER.info
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    21
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    22
class CORSFailed(Exception):
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    23
    """Raised when cross origin resource sharing checks failed"""
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    24
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    25
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    26
class CORSPreflight(Exception):
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    27
    """Raised when cross origin resource sharing checks detects the
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    28
    request as a valid preflight request"""
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    29
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    30
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    31
def process_request(req, config):
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    32
    """
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    33
    Process a request to apply CORS specification algorithms
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    34
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    35
    Check whether the CORS specification is respected and set corresponding
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    36
    headers to ensure response complies with the specification.
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    37
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    38
    In case of non-compliance, no CORS-related header is set.
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    39
    """
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    40
    base_url = urlparse.urlsplit(req.base_url())
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    41
    expected_host = '://'.join((base_url.scheme, base_url.netloc))
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    42
    if not req.get_header('Origin') or req.get_header('Origin') == expected_host:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    43
        # not a CORS request, nothing to do
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    44
        return
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    45
    try:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    46
        # handle cross origin resource sharing (CORS)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    47
        if req.http_method() == 'OPTIONS':
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    48
            if req.get_header('Access-Control-Request-Method'):
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    49
                # preflight CORS request
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    50
                process_preflight(req, config)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    51
        else: # Simple CORS or actual request
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    52
            process_simple(req, config)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    53
    except CORSFailed, exc:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    54
        info('Cross origin resource sharing failed: %s' % exc)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    55
    except CORSPreflight:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    56
        info('Cross origin resource sharing: valid Preflight request %s')
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    57
        raise
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    58
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    59
def process_preflight(req, config):
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    60
    """cross origin resource sharing (preflight)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    61
    Cf http://www.w3.org/TR/cors/#resource-preflight-requests
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    62
    """
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    63
    origin = check_origin(req, config)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    64
    allowed_methods = set(config['access-control-allow-methods'])
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    65
    allowed_headers = set(config['access-control-allow-headers'])
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    66
    try:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    67
        method = req.get_header('Access-Control-Request-Method')
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    68
    except ValueError:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    69
        raise CORSFailed('Access-Control-Request-Method is incorrect')
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    70
    if method not in allowed_methods:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    71
        raise CORSFailed('Method is not allowed')
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    72
    try:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    73
        req.get_header('Access-Control-Request-Headers', ())
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    74
    except ValueError:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    75
        raise CORSFailed('Access-Control-Request-Headers is incorrect')
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    76
    req.set_header('Access-Control-Allow-Methods', allowed_methods, raw=False)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    77
    req.set_header('Access-Control-Allow-Headers', allowed_headers, raw=False)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    78
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    79
    process_common(req, config, origin)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    80
    raise CORSPreflight()
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    81
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    82
def process_simple(req, config):
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    83
    """Handle the Simple Cross-Origin Request case
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    84
    """
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    85
    origin = check_origin(req, config)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    86
    exposed_headers = config['access-control-expose-headers']
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    87
    if exposed_headers:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    88
        req.set_header('Access-Control-Expose-Headers', exposed_headers, raw=False)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    89
    process_common(req, config, origin)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    90
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    91
def process_common(req, config, origin):
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    92
    req.set_header('Access-Control-Allow-Origin', origin)
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    93
    # in CW, we always support credential/authentication
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    94
    req.set_header('Access-Control-Allow-Credentials', 'true')
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    95
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    96
def check_origin(req, config):
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    97
    origin = req.get_header('Origin').lower()
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    98
    allowed_origins = config.get('access-control-allow-origin')
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
    99
    if not allowed_origins:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   100
        raise CORSFailed('access-control-allow-origin is not configured')
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   101
    if '*' not in allowed_origins and origin not in allowed_origins:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   102
        raise CORSFailed('Origin is not allowed')
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   103
    # bit of sanity check; see "6.3 Security"
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   104
    myhost = urlparse.urlsplit(req.base_url()).netloc
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   105
    host = req.get_header('Host')
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   106
    if host != myhost:
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   107
        info('cross origin resource sharing detected possible '
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   108
             'DNS rebinding attack Host header != host of base_url: '
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   109
             '%s != %s' % (host, myhost))
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   110
        raise CORSFailed('Host header and hostname do not match')
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   111
    # include "Vary: Origin" header (see 6.4)
10002
586d0e527052 [web/cors] don't overwrite other Vary headers
Julien Cristau <julien.cristau@logilab.fr>
parents: 9571
diff changeset
   112
    req.headers_out.addHeader('Vary', 'Origin')
9571
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   113
    return origin
aaf83cc07eed [web] implement cross origin resource sharing (CORS) (closes #2491768)
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents:
diff changeset
   114