n/nyxmuks
1
0
Fork 0
forked from Mirrors/gomuks
Code Pull requests Activity

server: only validate sec-fetch headers if present

Browse source
This commit is contained in:
Tulir Asokan 2024-10-15 12:03:06 +03:00
parent a4d1a7feeb
commit 90e68875f1
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
server.go
View file

@ -76,7 +76,7 @@ func (gmx *Gomuks) StartServer() {
}
var (
ErrInvalidHeader = mautrix.RespError{ErrCode: "FI.MAU.GOMUKS.INVALID_HEADER", StatusCode: http.StatusBadRequest}
ErrInvalidHeader = mautrix.RespError{ErrCode: "FI.MAU.GOMUKS.INVALID_HEADER", StatusCode: http.StatusForbidden}
ErrMissingCookie = mautrix.RespError{ErrCode: "FI.MAU.GOMUKS.MISSING_COOKIE", Err: "Missing gomuks_auth cookie", StatusCode: http.StatusUnauthorized}
ErrInvalidCookie = mautrix.RespError{ErrCode: "FI.MAU.GOMUKS.INVALID_COOKIE", Err: "Invalid gomuks_auth cookie", StatusCode: http.StatusUnauthorized}
)
@ -166,7 +166,13 @@ func isUserFetch(header http.Header) bool {
func (gmx *Gomuks) AuthMiddleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.Header.Get("Sec-WebSocket-Key") == "" && r.Header.Get("Sec-Fetch-Site") != "same-origin" && !isUserFetch(r.Header) {
if r.Header.Get("Sec-Fetch-Site") != "" && r.Header.Get("Sec-Fetch-Site") != "same-origin" && !isUserFetch(r.Header) {
hlog.FromRequest(r).Debug().
Str("site", r.Header.Get("Sec-Fetch-Site")).
Str("dest", r.Header.Get("Sec-Fetch-Dest")).
Str("mode", r.Header.Get("Sec-Fetch-Mode")).
Str("user", r.Header.Get("Sec-Fetch-User")).
Msg("Invalid Sec-Fetch-Site header")
ErrInvalidHeader.WithMessage("Invalid Sec-Fetch-Site header").Write(w)
return
}