search

r0man / ring-cors

Ring middleware for Cross-Origin Resource Sharing.
http://github.com/r0man/ring-cors
166 stars 44 forks source link

Only Trigger the middleware on Origin/Host mismatch #15

Open gbuisson opened 7 years ago

gbuisson commented 7 years ago

The current condition for ring-cors to be triggered is only to check the presence of an Origin header on the request.

Some browsers like Chrome always send that header even for same domain origin requests, thus ring-cors is triggered where it shouldn't, leading to unexpected behavior.

I think it would be best to check the presence of Origin as well as a mismatch between Origin and Host instead.

r0man commented 7 years ago

@gbuisson Yes, I think that's a valid strategy. Patch welcome! ;)