origin checker refactor (#7889)

api/websocket.go

@@ -18,12 +18,10 @@ func (api *API) InitWebSocket() {
 }
 
 func connect(c *Context, w http.ResponseWriter, r *http.Request) {
-	originChecker := utils.GetOriginChecker(r)
-
 	upgrader := websocket.Upgrader{
 		ReadBufferSize:  model.SOCKET_MAX_MESSAGE_SIZE_KB,
 		WriteBufferSize: model.SOCKET_MAX_MESSAGE_SIZE_KB,
-		CheckOrigin:     originChecker,
+		CheckOrigin:     c.App.OriginChecker(),
 	}
 
 	ws, err := upgrader.Upgrade(w, r, nil)

api4/websocket.go

@@ -19,12 +19,10 @@ func (api *API) InitWebSocket() {
 }
 
 func connectWebSocket(c *Context, w http.ResponseWriter, r *http.Request) {
-	originChecker := utils.GetOriginChecker(r)
-
 	upgrader := websocket.Upgrader{
 		ReadBufferSize:  model.SOCKET_MAX_MESSAGE_SIZE_KB,
 		WriteBufferSize: model.SOCKET_MAX_MESSAGE_SIZE_KB,
-		CheckOrigin:     originChecker,
+		CheckOrigin:     c.App.OriginChecker(),
 	}
 
 	ws, err := upgrader.Upgrade(w, r, nil)

app/server.go

@@ -58,8 +58,8 @@ type CorsWrapper struct {
 }
 
 func (cw *CorsWrapper) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	if len(*cw.config().ServiceSettings.AllowCorsFrom) > 0 {
+	if allowed := *cw.config().ServiceSettings.AllowCorsFrom; allowed != "" {
-		if utils.OriginChecker(r) {
+		if utils.CheckOrigin(r, allowed) {
 			w.Header().Set("Access-Control-Allow-Origin", r.Header.Get("Origin"))
 
 			if r.Method == "OPTIONS" {
@@ -252,6 +252,13 @@ func (a *App) StopServer() {
 	}
 }
 
+func (a *App) OriginChecker() func(*http.Request) bool {
+	if allowed := *a.Config().ServiceSettings.AllowCorsFrom; allowed != "" {
+		return utils.OriginChecker(allowed)
+	}
+	return nil
+}
+
 // This is required to re-use the underlying connection and not take up file descriptors
 func consumeAndClose(r *http.Response) {
 	if r.Body != nil {

utils/api.go

@@ -11,14 +11,12 @@ import (
 	"github.com/mattermost/mattermost-server/model"
 )
 
-type OriginCheckerProc func(*http.Request) bool
+func CheckOrigin(r *http.Request, allowedOrigins string) bool {
-
-func OriginChecker(r *http.Request) bool {
 	origin := r.Header.Get("Origin")
-	if *Cfg.ServiceSettings.AllowCorsFrom == "*" {
+	if allowedOrigins == "*" {
 		return true
 	}
-	for _, allowed := range strings.Split(*Cfg.ServiceSettings.AllowCorsFrom, " ") {
+	for _, allowed := range strings.Split(allowedOrigins, " ") {
 		if allowed == origin {
 			return true
 		}
@@ -26,12 +24,10 @@ func OriginChecker(r *http.Request) bool {
 	return false
 }
 
-func GetOriginChecker(r *http.Request) OriginCheckerProc {
+func OriginChecker(allowedOrigins string) func(*http.Request) bool {
-	if len(*Cfg.ServiceSettings.AllowCorsFrom) > 0 {
+	return func(r *http.Request) bool {
-		return OriginChecker
+		return CheckOrigin(r, allowedOrigins)
 	}
-
-	return nil
 }
 
 func RenderWebError(err *model.AppError, w http.ResponseWriter, r *http.Request) {