From 376178b9618f0882d94a959ea470f97594908b1c Mon Sep 17 00:00:00 2001 From: Felix Lange Date: Fri, 19 Jul 2019 15:57:57 +0200 Subject: [PATCH] rpc: remove default origin for client connections The client used to put the local hostname into the Origin header because the server wanted an origin to accept the connection, but that's silly: Origin is for browsers/websites. The nobody would whitelist a particular hostname. Now that the server doesn't need Origin anymore, don't bother setting one for clients. Users who need an origin can use DialWebsocket to create a client with arbitrary origin if needed. --- rpc/websocket.go | 12 ------------ rpc/websocket_test.go | 4 ++-- 2 files changed, 2 insertions(+), 14 deletions(-) diff --git a/rpc/websocket.go b/rpc/websocket.go index 93fa6b3798..26d736da81 100644 --- a/rpc/websocket.go +++ b/rpc/websocket.go @@ -140,18 +140,6 @@ func wsClientHeaders(endpoint, origin string) (string, http.Header, error) { if err != nil { return endpoint, nil, err } - if origin == "" { - var err error - if origin, err = os.Hostname(); err != nil { - return endpoint, nil, err - } - if endpointURL.Scheme == "wss" { - origin = "https://" + strings.ToLower(origin) - } else { - origin = "http://" + strings.ToLower(origin) - } - } - header := make(http.Header) header.Add("origin", origin) if endpointURL.User != nil { diff --git a/rpc/websocket_test.go b/rpc/websocket_test.go index 6cf15d3760..f150918d40 100644 --- a/rpc/websocket_test.go +++ b/rpc/websocket_test.go @@ -31,7 +31,7 @@ import ( func TestWebsocketClientHeaders(t *testing.T) { t.Parallel() - endpoint, header, err := wsClientHeaders("wss://testuser:test-PASS_01@example.com:1234", "") + endpoint, header, err := wsClientHeaders("wss://testuser:test-PASS_01@example.com:1234", "https://example.com") if err != nil { t.Fatalf("wsGetConfig failed: %s", err) } @@ -41,7 +41,7 @@ func TestWebsocketClientHeaders(t *testing.T) { if header.Get("authorization") != "Basic dGVzdHVzZXI6dGVzdC1QQVNTXzAx" { t.Fatal("Basic auth header is incorrect") } - if header.Get("origin") == "" { + if header.Get("origin") != "https://example.com" { t.Fatal("Origin not set") } }