Open robdyck opened 3 years ago
Perhaps we shall use a switch as a mod param to force or not the Origin header.
For my own testing, I simply eliminated references to that header. Opensips does nothing with it anyway. It works fine whether the connection is from a browser or not.
I've just pushed a commit to add the reuqire_origin
parameter, that can be turned off. The parameter is available for both proto_ws
and proto_wss
modules.
Please give it a try and let us know if it serves your purpose.
OpenSIPS version you are running
Describe the bug
According to rfc 6455 the origin header in a websocket handshake is always present when the handshake originates from a web browser but otherwise is optional and not really useful. In a SIP context the "origin" is present when a UA is running in a web browser eg: sipified WebRTC.
A problem arises when a non-browser UA attempts a handshake eg: baresip. Opensips arbitrarily drops the connection although for this use case "origin" is not required.
There does not appear to be any origin filtering in tls_mgm. Origin could simply be ignored and the connection accepted. On the other hand filtering should be done in the case of browser based UAs as per the RFC. eg: https://example.com. Origin is supposed to prevent session hijacking in the browser.
If the header is missing just accept the connection and assume a non-browser origin.
To Reproduce
Configure baresip to register via websocket and start it.
Expected behavior
Baresip registers successfully.
Relevant System Logs
Additional context