[web/cors] don't overwrite other Vary headers
Vary is a list of request headers, we shouldn't override others.
# -*- coding: utf-8 -*-
# copyright 2014 Logilab, PARIS
"""A set of utility functions to handle CORS requests
Unless specified, all references in this file are related to:
http://www.w3.org/TR/cors
The provided implementation roughly follows:
http://www.html5rocks.com/static/images/cors_server_flowchart.png
See also:
https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS
"""
import urlparse
from cubicweb.web import LOGGER
info = LOGGER.info
class CORSFailed(Exception):
"""Raised when cross origin resource sharing checks failed"""
class CORSPreflight(Exception):
"""Raised when cross origin resource sharing checks detects the
request as a valid preflight request"""
def process_request(req, config):
"""
Process a request to apply CORS specification algorithms
Check whether the CORS specification is respected and set corresponding
headers to ensure response complies with the specification.
In case of non-compliance, no CORS-related header is set.
"""
base_url = urlparse.urlsplit(req.base_url())
expected_host = '://'.join((base_url.scheme, base_url.netloc))
if not req.get_header('Origin') or req.get_header('Origin') == expected_host:
# not a CORS request, nothing to do
return
try:
# handle cross origin resource sharing (CORS)
if req.http_method() == 'OPTIONS':
if req.get_header('Access-Control-Request-Method'):
# preflight CORS request
process_preflight(req, config)
else: # Simple CORS or actual request
process_simple(req, config)
except CORSFailed, exc:
info('Cross origin resource sharing failed: %s' % exc)
except CORSPreflight:
info('Cross origin resource sharing: valid Preflight request %s')
raise
def process_preflight(req, config):
"""cross origin resource sharing (preflight)
Cf http://www.w3.org/TR/cors/#resource-preflight-requests
"""
origin = check_origin(req, config)
allowed_methods = set(config['access-control-allow-methods'])
allowed_headers = set(config['access-control-allow-headers'])
try:
method = req.get_header('Access-Control-Request-Method')
except ValueError:
raise CORSFailed('Access-Control-Request-Method is incorrect')
if method not in allowed_methods:
raise CORSFailed('Method is not allowed')
try:
req.get_header('Access-Control-Request-Headers', ())
except ValueError:
raise CORSFailed('Access-Control-Request-Headers is incorrect')
req.set_header('Access-Control-Allow-Methods', allowed_methods, raw=False)
req.set_header('Access-Control-Allow-Headers', allowed_headers, raw=False)
process_common(req, config, origin)
raise CORSPreflight()
def process_simple(req, config):
"""Handle the Simple Cross-Origin Request case
"""
origin = check_origin(req, config)
exposed_headers = config['access-control-expose-headers']
if exposed_headers:
req.set_header('Access-Control-Expose-Headers', exposed_headers, raw=False)
process_common(req, config, origin)
def process_common(req, config, origin):
req.set_header('Access-Control-Allow-Origin', origin)
# in CW, we always support credential/authentication
req.set_header('Access-Control-Allow-Credentials', 'true')
def check_origin(req, config):
origin = req.get_header('Origin').lower()
allowed_origins = config.get('access-control-allow-origin')
if not allowed_origins:
raise CORSFailed('access-control-allow-origin is not configured')
if '*' not in allowed_origins and origin not in allowed_origins:
raise CORSFailed('Origin is not allowed')
# bit of sanity check; see "6.3 Security"
myhost = urlparse.urlsplit(req.base_url()).netloc
host = req.get_header('Host')
if host != myhost:
info('cross origin resource sharing detected possible '
'DNS rebinding attack Host header != host of base_url: '
'%s != %s' % (host, myhost))
raise CORSFailed('Host header and hostname do not match')
# include "Vary: Origin" header (see 6.4)
req.headers_out.addHeader('Vary', 'Origin')
return origin