11package httpp
22
33import (
4- "errors"
54 "net"
65 "net/http"
76 "net/url"
87 "regexp"
98 "strings"
109)
1110
12- var errOriginNotAllowed = errors .New ("origin not allowed" )
13-
14- func isOriginAllowed (origin string , allowOrigins []string ) (string , error ) {
11+ func isOriginAllowed (origin string , allowOrigins []string ) (string , bool ) {
1512 if len (allowOrigins ) == 0 {
16- return "" , errOriginNotAllowed
13+ return "" , false
1714 }
1815
1916 for _ , o := range allowOrigins {
2017 if o == "*" {
21- return o , nil
18+ return o , true
2219 }
2320 }
2421
2522 if origin == "" {
26- return "" , errOriginNotAllowed
23+ return "" , false
2724 }
2825
2926 originURL , err := url .Parse (origin )
3027 if err != nil || originURL .Scheme == "" {
31- return "" , errOriginNotAllowed
28+ return "" , false
3229 }
3330
3431 if originURL .Port () == "" && originURL .Scheme != "" {
@@ -58,20 +55,20 @@ func isOriginAllowed(origin string, allowOrigins []string) (string, error) {
5855 if allowedURL .Scheme == originURL .Scheme &&
5956 allowedURL .Host == originURL .Host &&
6057 allowedURL .Port () == originURL .Port () {
61- return origin , nil
58+ return origin , true
6259 }
6360
6461 if strings .Contains (allowedURL .Host , "*" ) {
6562 pattern := strings .ReplaceAll (allowedURL .Host , "*." , "(.*\\ .)?" )
6663 pattern = strings .ReplaceAll (pattern , "*" , ".*" )
6764 matched , errMatched := regexp .MatchString ("^" + pattern + "$" , originURL .Host )
6865 if errMatched == nil && matched {
69- return origin , nil
66+ return origin , true
7067 }
7168 }
7269 }
7370
74- return "" , errOriginNotAllowed
71+ return "" , false
7572}
7673
7774// add Access-Control-Allow-Origin and Access-Control-Allow-Credentials
@@ -81,8 +78,8 @@ type handlerOrigin struct {
8178}
8279
8380func (h * handlerOrigin ) ServeHTTP (w http.ResponseWriter , r * http.Request ) {
84- origin , err := isOriginAllowed (r .Header .Get ("Origin" ), h .allowOrigins )
85- if err == nil {
81+ origin , ok := isOriginAllowed (r .Header .Get ("Origin" ), h .allowOrigins )
82+ if ! ok {
8683 w .Header ().Set ("Access-Control-Allow-Origin" , origin )
8784 w .Header ().Set ("Access-Control-Allow-Credentials" , "true" )
8885 }
0 commit comments