Fixing websocket origin policy

api/websocket.go

@@ -23,9 +23,7 @@ func connect(c *Context, w http.ResponseWriter, r *http.Request) {
 	upgrader := websocket.Upgrader{
 		ReadBufferSize:  model.SOCKET_MAX_MESSAGE_SIZE_KB,
 		WriteBufferSize: model.SOCKET_MAX_MESSAGE_SIZE_KB,
-		CheckOrigin: func(r *http.Request) bool {
+		CheckOrigin:     nil,
-			return true
-		},
 	}
 
 	ws, err := upgrader.Upgrade(w, r, nil)

api/websocket_test.go

@@ -6,12 +6,14 @@ package api
 import (
 	//"encoding/json"
 	//"net/http"
+	"net/http"
 	"testing"
 	"time"
 
-	//"github.com/gorilla/websocket"
+	"github.com/gorilla/websocket"
 	"github.com/mattermost/platform/app"
 	"github.com/mattermost/platform/model"
+	"github.com/mattermost/platform/utils"
 )
 
 /*func TestWebSocketAuthentication(t *testing.T) {
@@ -249,6 +251,27 @@ func TestWebSocketEvent(t *testing.T) {
 	}
 }
 
+func TestWebsocketOriginSecurity(t *testing.T) {
+	Setup().InitBasic()
+	url := "ws://localhost" + utils.Cfg.ServiceSettings.ListenAddress
+
+	// Should fail because origin doesn't match
+	_, _, err := websocket.DefaultDialer.Dial(url+model.API_URL_SUFFIX_V3+"/users/websocket", http.Header{
+		"Origin": []string{"http://www.evil.com"},
+	})
+	if err == nil {
+		t.Fatal("Should have errored because Origin does not match host! SECURITY ISSUE!")
+	}
+
+	// We are not a browser so we can spoof this just fine
+	_, _, err = websocket.DefaultDialer.Dial(url+model.API_URL_SUFFIX_V3+"/users/websocket", http.Header{
+		"Origin": []string{"http://localhost" + utils.Cfg.ServiceSettings.ListenAddress},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestZZWebSocketTearDown(t *testing.T) {
 	// *IMPORTANT* - Kind of hacky
 	// This should be the last function in any test file