{"action":"opened","issue":{"url":"https://api.github.com/repos/ampproject/amp-toolbox/issues/487","repository_url":"https://api.github.com/repos/ampproject/amp-toolbox","labels_url":"https://api.github.com/repos/ampproject/amp-toolbox/issues/487/labels{/name}","comments_url":"https://api.github.com/repos/ampproject/amp-toolbox/issues/487/comments","events_url":"https://api.github.com/repos/ampproject/amp-toolbox/issues/487/events","html_url":"https://github.com/ampproject/amp-toolbox/issues/487","id":491378923,"node_id":"MDU6SXNzdWU0OTEzNzg5MjM=","number":487,"title":"Origin check fails when both origin and amp-same-origin headers are present","user":{"login":"wille","id":1017440,"node_id":"MDQ6VXNlcjEwMTc0NDA=","avatar_url":"https://avatars0.githubusercontent.com/u/1017440?v=4","gravatar_id":"","url":"https://api.github.com/users/wille","html_url":"https://github.com/wille","followers_url":"https://api.github.com/users/wille/followers","following_url":"https://api.github.com/users/wille/following{/other_user}","gists_url":"https://api.github.com/users/wille/gists{/gist_id}","starred_url":"https://api.github.com/users/wille/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wille/subscriptions","organizations_url":"https://api.github.com/users/wille/orgs","repos_url":"https://api.github.com/users/wille/repos","events_url":"https://api.github.com/users/wille/events{/privacy}","received_events_url":"https://api.github.com/users/wille/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-09-09T23:50:02Z","updated_at":"2019-09-09T23:50:02Z","closed_at":null,"author_association":"NONE","body":"Chrome `Version 75.0.3770.100 (Official Build) (64-bit)`\r\nSends `origin` headers on same origin requests along with `amp-same-origin` whereas Chromium `Version 76.0.3809.132 (Official Build) Arch Linux (64-bit)` does not\r\n\r\nFrom the docs\r\n> As this request is from the same origin, there is no Origin header but the custom AMP request header of AMP-Same-Origin: true\r\n\r\n`origin` gets picked up before the `amp-same-origin` header [here](https://github.com/ampproject/amp-toolbox/blob/master/packages/cors/lib/cors.js#L122) which fails the origin check [here](https://github.com/ampproject/amp-toolbox/blob/master/packages/cors/lib/cors.js#L78)\r\n\r\nI'm opening a PR to check for `amp-same-origin` before `origin` which will solve this issue.\r\n\r\nI would say it isn't expected to receive `origin` in same origin requests but [according to RFC](https://tools.ietf.org/html/rfc6454#section-7.3) it may"}}
{"actor":{"display_login":"wille"}}