CORS security flaw
See original GitHub issueActual behaviour
Javalin running with CORS allowed origin of https://api.securesite.com
, works with header Origin: https://api.securesite.com
as expected.
I register an Australian site of https://api.securesite.com.au and request the API above with Origin: https://api.securesite.com.au
- Javalin CORS will respond with Access-Control-Allow-Origin: https://api.securesite.com.au
and Access-Control-Allow-Credentials: true
Expected behavior
For the example above Origin: https://api.securesite.com.au
should not be allowed.
To Reproduce See above.
Additional context I believe the fix is simple - just change startsWith to an equals. https://github.com/tipsy/javalin/blob/3acf47d9c97cb593426056749ff4304781700d86/javalin/src/main/java/io/javalin/http/util/CorsUtil.kt#L17
Issue Analytics
- State:
- Created 3 years ago
- Comments:5 (5 by maintainers)
Sure - why not. I’ll try to do it later 😃
Nice, thank you! I agree that it’s better to not break existing code that relies on the
removeSuffix
mapping.