vw_small

Hardened fork of Vaultwarden (https://github.com/dani-garcia/vaultwarden) with fewer features.
git clone https://git.philomathiclife.com/repos/vw_small
Log | Files | Refs | README

commit 5a2f968d7a868fcfed2c67055ada88dd7a8db06b
parent 16d88402cbeb51d376d14c9d32e2bc00d00e4cb2
Author: vpl <vpl@vpl.me>
Date:   Mon,  2 Sep 2019 21:13:12 +0200

Set correct response headers, status code

Diffstat:
Msrc/util.rs | 32++++++++++++++++++++++----------
1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/src/util.rs b/src/util.rs @@ -4,7 +4,7 @@ use rocket::fairing::{Fairing, Info, Kind}; use rocket::response::{self, Responder}; use rocket::{Request, Response}; -use rocket::http::{Header, ContentType, Method}; +use rocket::http::{Header, HeaderMap, ContentType, Method, Status}; use std::io::Cursor; pub struct AppHeaders(); @@ -33,9 +33,17 @@ impl Fairing for AppHeaders { } } - pub struct CORS(); +impl CORS { + fn get_header(headers: &HeaderMap, name: &str) -> String { + match headers.get_one(name) { + Some(h) => h.to_string(), + _ => "".to_string(), + } + } +} + impl Fairing for CORS { fn info(&self) -> Info { Info { @@ -45,21 +53,25 @@ impl Fairing for CORS { } fn on_response(&self, request: &Request, response: &mut Response) { - // We need to explictly get the Origin header for Access-Control-Allow-Origin - let origin = match request.headers().get_one("Origin") { - Some(h) => h.to_string(), - _ => "".to_string(), - }; + let req_headers = request.headers(); + + // We need to explicitly get the Origin header for Access-Control-Allow-Origin + let req_allow_origin = CORS::get_header(&req_headers, "Origin"); + + let req_allow_headers = CORS::get_header(&req_headers, "Access-Control-Request-Headers"); + + let req_allow_methods =CORS::get_header(&req_headers,"Access-Control-Request-Methods"); if request.method() == Method::Options || response.content_type() == Some(ContentType::JSON) { // Requests with credentials need explicit values since they do not allow wildcards. - response.set_header(Header::new("Access-Control-Allow-Origin", origin)); - response.set_header(Header::new("Access-Control-Allow-Methods", "GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH")); - response.set_header(Header::new("Access-Control-Allow-Headers", "*, Authorization")); + response.set_header(Header::new("Access-Control-Allow-Origin", req_allow_origin)); + response.set_header(Header::new("Access-Control-Allow-Methods", req_allow_methods)); + response.set_header(Header::new("Access-Control-Allow-Headers", req_allow_headers)); response.set_header(Header::new("Access-Control-Allow-Credentials", "true")); } if request.method() == Method::Options { + response.set_status(Status::Ok); response.set_header(ContentType::Plain); response.set_sized_body(Cursor::new("")); }