src/httprpc.cpp
// Martkist This is not a CORS check. Only check if OPTIONS are
// set in order to allow localhost to localhost communications
Martkist This is not a CORS check. Only check if OPTIONS are
set in order to allow localhost to localhost communications
Martkist This is not a CORS check . Only check if OPTIONS are set in order to allow localhost to localhost communications
static bool checkPreflight(HTTPRequest* req)
{
    std::pair<bool, std::string> origin = req->GetHeader("origin");
    if (!origin.first) {
        return false;
    }
    if (req->GetRequestMethod() == HTTPRequest::OPTIONS) {
        std::pair<bool, std::string> method =
            req->GetHeader("access-control-request-method");
        if (!method.first) {
            return false;
        }
        std::pair<bool, std::string> header_field_names =
            req->GetHeader("access-control-request-headers");
        if (method.second != "POST") {
            return false;
        }
        const std::string& list_of_headers = "authorization,content-type";
        req->WriteHeader("Access-Control-Allow-Origin", origin.second);
        req->WriteHeader("Access-Control-Allow-Methods", method.second);
        req->WriteHeader(
            "Access-Control-Allow-Headers",
            header_field_names.first ? header_field_names.second
                                        : list_of_headers);
        req->WriteReply(HTTP_OK);
        return true;
    }
     Access-Control-Allow-Credentials
    req->WriteHeader("Access-Control-Allow-Origin", origin.second);
    req->WriteHeader("Access-Control-Expose-Headers", "WWW-Authenticate");
    return false;
}
static bool checkPreflight ( HTTPRequest * req ) { std :: pair < bool , std :: string > origin = req -> GetHeader ( " " ) ; if ( ! origin . first ) { return false ; } if ( req -> GetRequestMethod ( ) == HTTPRequest :: OPTIONS ) { std :: pair < bool , std :: string > method = req -> GetHeader ( " " ) ; if ( ! method . first ) { return false ; } std :: pair < bool , std :: string > header_field_names = req -> GetHeader ( " " ) ; if ( method . second != " " ) { return false ; } const std :: string & list_of_headers = " " ; req -> WriteHeader ( " " , origin . second ) ; req -> WriteHeader ( " " , method . second ) ; req -> WriteHeader ( " " , header_field_names . first ? header_field_names . second : list_of_headers ) ; req -> WriteReply ( HTTP_OK ) ; return true ; } req -> WriteHeader ( " " , origin . second ) ; req -> WriteHeader ( " " , " " ) ; return false ; }
Martkist This is not a CORS check.
Martkist This is not a CORS check .
// https://www.w3.org/TR/cors/#resource-requests // 1. If the Origin header is not present terminate this set of steps. // The request is outside the scope of this specification. // Martkist Keep origin so as not to have to set Access-Control-Allow-Origin // to * // 2. If the value of the Origin header is not a case-sensitive match for // any of the values in list of origins do not set any additional headers // and terminate this set of steps. // Note: Always matching is acceptable since the list of origins can be // unbounded. // Martkist We are only satifying the OPTIONS request in this method in order to // allow localhost to localhost communications. If CORS is implemented origin // would be checked against an acceptable domain // if (origin.second != strRPCCORSDomain) { //     return false; // } // 6.2 Preflight Request // In response to a preflight request the resource indicates which // methods and headers (other than simple methods and simple // headers) it is willing to handle and whether it supports // credentials. // Resources must use the following set of steps to determine which // additional headers to use in the response: // 3. Let method be the value as result of parsing the // Access-Control-Request-Method header. // If there is no Access-Control-Request-Method header or if parsing // failed, do not set any additional headers and terminate this set // of steps. The request is outside the scope of this specification. // 4. Let header field-names be the values as result of parsing // the Access-Control-Request-Headers headers. // If there are no Access-Control-Request-Headers headers let header // field-names be the empty list. // If parsing failed do not set any additional headers and terminate // this set of steps. The request is outside the scope of this // specification. // 5. If method is not a case-sensitive match for any of the // values in list of methods do not set any additional headers // and terminate this set of steps. // Note: Always matching is acceptable since the list of methods // can be unbounded. // 6. If any of the header field-names is not a ASCII case- // insensitive match for any of the values in list of headers do not // set any additional headers and terminate this set of steps. // Note: Always matching is acceptable since the list of headers can // be unbounded. // 7. If the resource supports credentials add a single // Access-Control-Allow-Origin header, with the value of the Origin // header as value, and add a single // Access-Control-Allow-Credentials header with the case-sensitive // string "true" as value. // Martkist as we are only handling OPTIONS there is // no need to expose the response //req->WriteHeader("Access-Control-Allow-Credentials", "true"); // 8. Optionally add a single Access-Control-Max-Age header with as // value the amount of seconds the user agent is allowed to cache // the result of the request. // 9. If method is a simple method this step may be skipped. // Add one or more Access-Control-Allow-Methods headers consisting // of (a subset of) the list of methods. // If a method is a simple method it does not need to be listed, but // this is not prohibited. // Note: Since the list of methods can be unbounded, simply // returning the method indicated by // Access-Control-Request-Method (if supported) can be enough. // 10. If each of the header field-names is a simple header and none // is Content-Type, this step may be skipped. // Add one or more Access-Control-Allow-Headers headers consisting // of (a subset of) the list of headers. // 6.1 Simple Cross-Origin Request, Actual Request, and Redirects // In response to a simple cross-origin request or actual request the // resource indicates whether or not to share the response. // If the resource has been relocated, it indicates whether to share its // new URL. // Resources must use the following set of steps to determine which // additional headers to use in the response: // 3. If the resource supports credentials add a single // Access-Control-Allow-Origin header, with the value of the Origin // header as value, and add a single Access-Control-Allow-Credentials // header with the case-sensitive string "true" as value. // Martkist as we are only handling OPTIONS there is // no need to expose the response // req->WriteHeader("Access-Control-Allow-Credentials", "true"); // 4. If the list of exposed headers is not empty add one or more // Access-Control-Expose-Headers headers, with as values the header // field names given in the list of exposed headers.