Commit d1f2240
[FIX] regex not allowed for cors_origins
Steps to reproduce:
Adding origins such as chrome-extension://{id} or moz-extension://{id}
through the UI causes the server to crash at startup without any explanation.
When trying to start the server manually, an error is displayed
```
[ERROR][panic]: thread 'main' panicked at 'Failed to set up CORS:
OpaqueAllowedOrigin(["chrome-extension://{any_id}"])':
aw-server/src/endpoints/cors.rs:69
```
Source:
This happens because these schemes are not valid for allowed_exact_origins
and are treated as opaque origins by the CORS layer.
The server currently allows any string to be inserted into:
allowed_exact_origins (via cors)
allowed_regex_origins (via cors_regex)
However, non-HTTP schemes (chrome-extension://, moz-extension://, etc.) are invalid
in allowed_exact_origins and cause a panic when initializing CORS.
Solution:
Short term Solution: Validate origins before inserting them into allowed_exact_origins to accept only
http:// and https://
Other Solutions:
1- add a regex_cors field
2- accept regex for browser extensions and put the automatically in allowed_regex_origins1 parent 9c12597 commit d1f2240
2 files changed
Lines changed: 3 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
8 | 8 | | |
9 | 9 | | |
10 | 10 | | |
| 11 | + | |
| 12 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
21 | 21 | | |
22 | 22 | | |
23 | 23 | | |
24 | | - | |
25 | | - | |
26 | | - | |
| 24 | + | |
27 | 25 | | |
28 | 26 | | |
29 | 27 | | |
| |||
0 commit comments