added support for multiple allowed origins

arianne · Jun 12, 2023 · 42d42ce · 42d42ce
1 parent 91754ae
commit 42d42ce
Showing 1 changed file with 15 additions and 1 deletion.
diff --git a/src/marauroa/server/net/web/WebSocketChannel.java b/src/marauroa/server/net/web/WebSocketChannel.java
@@ -64,7 +64,7 @@ public void onOpen(Session session, EndpointConfig config) {
 		String origin = params.get("origin").get(0);
 		try {
 			String expectedOrigin = Configuration.getConfiguration().get("http_origin");
-			if ((expectedOrigin != null) && !expectedOrigin.equals(origin)) {
+			if (!validateOrigin(origin, expectedOrigin)) {
 				logger.warn("Expected origin " + expectedOrigin + " from client " + address + " but got " + origin);
 				close();
 				return;
@@ -85,6 +85,20 @@ public void onOpen(Session session, EndpointConfig config) {
 	}
 
 
+	private boolean validateOrigin(String origin, String expectedOrigin) {
+		if (expectedOrigin == null) {
+			return true;
+		}
+		String[] expectedOrigins = expectedOrigin.split(",");
+		for (String exp : expectedOrigins) {
+			if (exp.equals(origin)) {
+				return true;
+			}
+		}
+		return false;
+	}
+
+
 	@OnMessage
 	public void onWebSocketText(String message) {
 		String msg = DebugInterface.get().onMessage(useragent, message);