d138755806
String prefix matching is hacky and provides insufficient checking if it does not end with a /.
36 lines
955 B
Go
36 lines
955 B
Go
package main
|
|
|
|
import (
|
|
"net/http"
|
|
"net/url"
|
|
)
|
|
|
|
// Do a strict referrer check, matching against both the Origin header (if
|
|
// present) and the Referrer header. If a list of headers is specified, then
|
|
// Referrer checking will be skipped if any of those headers are present.
|
|
func strictReferrerCheck(r *http.Request, prefix string, whitelistHeaders []string) bool {
|
|
p, _ := url.Parse(prefix)
|
|
|
|
// if there's an Origin header, check it and skip other checks
|
|
if origin := r.Header.Get("Origin"); origin != "" {
|
|
u, _ := url.Parse(origin)
|
|
return sameOrigin(u, p)
|
|
}
|
|
|
|
for _, header := range whitelistHeaders {
|
|
if r.Header.Get(header) != "" {
|
|
return true
|
|
}
|
|
}
|
|
|
|
referrer := r.Header.Get("Referer")
|
|
u, _ := url.Parse(referrer)
|
|
return sameOrigin(u, p)
|
|
}
|
|
|
|
// Check if two URLs have the same origin
|
|
func sameOrigin(u1, u2 *url.URL) bool {
|
|
// host also contains the port if one was specified
|
|
return (u1.Scheme == u2.Scheme && u1.Host == u2.Host)
|
|
}
|