fix(gateway): include CORS on subdomain redirects (#9994)
Marcin Rataj committed
Jun 27, 2023 at 13:11 UTC
3da4e5b409d4d360a182ce44fd499c92422202cd
8 files changed
+41
-30
config/init.go
+2
-6
@@ -67,12 +67,8 @@ func InitWithIdentity(identity Identity) (*Config, error) {
67
RootRedirect: "",
68
NoFetch: false,
69
PathPrefixes: []string{},
70
- HTTPHeaders: map[string][]string{
71
- "Access-Control-Allow-Origin": {"*"},
72
- "Access-Control-Allow-Methods": {"GET"},
73
- "Access-Control-Allow-Headers": {"X-Requested-With", "Range", "User-Agent"},
74
- },
75
- APICommands: []string{},
70
+ HTTPHeaders: map[string][]string{},
71
+ APICommands: []string{},
72
},
73
Reprovider: Reprovider{
74
Interval: nil,
docs/examples/kubo-as-a-library/go.mod
+1
-1
@@ -7,7 +7,7 @@ go 1.18
7
replace github.com/ipfs/kubo => ./../../..
8
9
require (
10
- github.com/ipfs/boxo v0.10.2-0.20230620120822-417c5f7d61ff
10
+ github.com/ipfs/boxo v0.10.2-0.20230627105028-a87f9ed0b2a9
11
github.com/ipfs/kubo v0.0.0-00010101000000-000000000000
12
github.com/libp2p/go-libp2p v0.27.7
13
github.com/multiformats/go-multiaddr v0.9.0
docs/examples/kubo-as-a-library/go.sum
+2
-2
@@ -320,8 +320,8 @@ github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:
320
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
321
github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
322
github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
323
-github.com/ipfs/boxo v0.10.2-0.20230620120822-417c5f7d61ff h1:QnYD2h1e55nX9lSl5k8YVij1VIOICR7lPJlhbKOQjNM=
324
-github.com/ipfs/boxo v0.10.2-0.20230620120822-417c5f7d61ff/go.mod h1:OGMmq97krQBiKx8LRGyf5DgWHeu+PDdIHNN2YnQlWjs=
323
+github.com/ipfs/boxo v0.10.2-0.20230627105028-a87f9ed0b2a9 h1:n66pkk54aXcGOrK2qJm+krxLQJWzo88skyefbuFqU44=
324
+github.com/ipfs/boxo v0.10.2-0.20230627105028-a87f9ed0b2a9/go.mod h1:OGMmq97krQBiKx8LRGyf5DgWHeu+PDdIHNN2YnQlWjs=
325
github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
326
github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
327
github.com/ipfs/go-block-format v0.0.2/go.mod h1:AWR46JfpcObNfg3ok2JHDUfdiHRgWhJgCQF+KIgOPJY=
go.mod
+1
-1
@@ -15,7 +15,7 @@ require (
15
github.com/fsnotify/fsnotify v1.6.0
16
github.com/google/uuid v1.3.0
17
github.com/hashicorp/go-multierror v1.1.1
18
- github.com/ipfs/boxo v0.10.2-0.20230620120822-417c5f7d61ff
18
+ github.com/ipfs/boxo v0.10.2-0.20230627105028-a87f9ed0b2a9
19
github.com/ipfs/go-block-format v0.1.2
20
github.com/ipfs/go-cid v0.4.1
21
github.com/ipfs/go-cidutil v0.1.0
go.sum
+2
-2
@@ -355,8 +355,8 @@ github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:
355
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
356
github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
357
github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
358
-github.com/ipfs/boxo v0.10.2-0.20230620120822-417c5f7d61ff h1:QnYD2h1e55nX9lSl5k8YVij1VIOICR7lPJlhbKOQjNM=
359
-github.com/ipfs/boxo v0.10.2-0.20230620120822-417c5f7d61ff/go.mod h1:OGMmq97krQBiKx8LRGyf5DgWHeu+PDdIHNN2YnQlWjs=
358
+github.com/ipfs/boxo v0.10.2-0.20230627105028-a87f9ed0b2a9 h1:n66pkk54aXcGOrK2qJm+krxLQJWzo88skyefbuFqU44=
359
+github.com/ipfs/boxo v0.10.2-0.20230627105028-a87f9ed0b2a9/go.mod h1:OGMmq97krQBiKx8LRGyf5DgWHeu+PDdIHNN2YnQlWjs=
360
github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
361
github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
362
github.com/ipfs/go-block-format v0.0.2/go.mod h1:AWR46JfpcObNfg3ok2JHDUfdiHRgWhJgCQF+KIgOPJY=
test/dependencies/go.mod
+1
-1
@@ -7,7 +7,7 @@ replace github.com/ipfs/kubo => ../../
7
require (
8
github.com/Kubuxu/gocovmerge v0.0.0-20161216165753-7ecaa51963cd
9
github.com/golangci/golangci-lint v1.49.0
10
- github.com/ipfs/boxo v0.10.2-0.20230620120822-417c5f7d61ff
10
+ github.com/ipfs/boxo v0.10.2-0.20230627105028-a87f9ed0b2a9
11
github.com/ipfs/go-cid v0.4.1
12
github.com/ipfs/go-cidutil v0.1.0
13
github.com/ipfs/go-datastore v0.6.0
test/dependencies/go.sum
+2
-2
@@ -413,8 +413,8 @@ github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NH
413
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
414
github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
415
github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
416
-github.com/ipfs/boxo v0.10.2-0.20230620120822-417c5f7d61ff h1:QnYD2h1e55nX9lSl5k8YVij1VIOICR7lPJlhbKOQjNM=
417
-github.com/ipfs/boxo v0.10.2-0.20230620120822-417c5f7d61ff/go.mod h1:OGMmq97krQBiKx8LRGyf5DgWHeu+PDdIHNN2YnQlWjs=
416
+github.com/ipfs/boxo v0.10.2-0.20230627105028-a87f9ed0b2a9 h1:n66pkk54aXcGOrK2qJm+krxLQJWzo88skyefbuFqU44=
417
+github.com/ipfs/boxo v0.10.2-0.20230627105028-a87f9ed0b2a9/go.mod h1:OGMmq97krQBiKx8LRGyf5DgWHeu+PDdIHNN2YnQlWjs=
418
github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
419
github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
420
github.com/ipfs/go-block-format v0.1.2 h1:GAjkfhVx1f4YTODS6Esrj1wt2HhrtwTnhEr+DyPUaJo=
test/sharness/t0112-gateway-cors.sh
+30
-15
@@ -7,21 +7,9 @@ test_description="Test CORS behavior on Gateway port"
7
test_init_ipfs
8
9
# Default config
10
-test_expect_success "Default Gateway.HTTPHeaders config match expected values" '
10
+test_expect_success "Default Gateway.HTTPHeaders is empty (implicit CORS values from boxo/gateway)" '
11
cat <<EOF > expected
12
-{
13
- "Access-Control-Allow-Headers": [
14
- "X-Requested-With",
15
- "Range",
16
- "User-Agent"
17
- ],
18
- "Access-Control-Allow-Methods": [
19
- "GET"
20
- ],
21
- "Access-Control-Allow-Origin": [
22
- "*"
23
- ]
24
-}
12
+{}
13
EOF
14
ipfs config --json Gateway.HTTPHeaders > actual &&
15
test_cmp expected actual
@@ -43,13 +31,19 @@ test_expect_success "GET to Gateway succeeds" '
31
test_expect_success "GET response for Gateway resource looks good" '
32
test_should_contain "< Access-Control-Allow-Origin: \*" curl_output &&
33
test_should_contain "< Access-Control-Allow-Methods: GET" curl_output &&
34
+ test_should_contain "< Access-Control-Allow-Methods: HEAD" curl_output &&
35
+ test_should_contain "< Access-Control-Allow-Methods: OPTIONS" curl_output &&
36
+ test_should_contain "< Access-Control-Allow-Headers: Content-Type" curl_output &&
37
test_should_contain "< Access-Control-Allow-Headers: Range" curl_output &&
38
+ test_should_contain "< Access-Control-Allow-Headers: User-Agent" curl_output &&
39
+ test_should_contain "< Access-Control-Allow-Headers: X-Requested-With" curl_output &&
40
test_should_contain "< Access-Control-Expose-Headers: Content-Range" curl_output &&
41
test_should_contain "< Access-Control-Expose-Headers: Content-Length" curl_output &&
42
+ test_should_contain "< Access-Control-Expose-Headers: X-Chunked-Output" curl_output &&
43
+ test_should_contain "< Access-Control-Expose-Headers: X-Stream-Output" curl_output &&
44
test_should_contain "< Access-Control-Expose-Headers: X-Ipfs-Path" curl_output &&
45
test_should_contain "< Access-Control-Expose-Headers: X-Ipfs-Roots" curl_output
46
'
52
-
47
# HTTP OPTIONS Request
48
test_expect_success "OPTIONS to Gateway succeeds" '
49
curl -svX OPTIONS -H "Origin: https://example.com" "http://127.0.0.1:$GWAY_PORT/ipfs/$thash" 2>curl_output &&
@@ -60,13 +54,34 @@ test_expect_success "OPTIONS to Gateway succeeds" '
54
test_expect_success "OPTIONS response for Gateway resource looks good" '
55
test_should_contain "< Access-Control-Allow-Origin: \*" curl_output &&
56
test_should_contain "< Access-Control-Allow-Methods: GET" curl_output &&
57
+ test_should_contain "< Access-Control-Allow-Methods: HEAD" curl_output &&
58
+ test_should_contain "< Access-Control-Allow-Methods: OPTIONS" curl_output &&
59
+ test_should_contain "< Access-Control-Allow-Headers: Content-Type" curl_output &&
60
test_should_contain "< Access-Control-Allow-Headers: Range" curl_output &&
61
+ test_should_contain "< Access-Control-Allow-Headers: User-Agent" curl_output &&
62
+ test_should_contain "< Access-Control-Allow-Headers: X-Requested-With" curl_output &&
63
test_should_contain "< Access-Control-Expose-Headers: Content-Range" curl_output &&
64
test_should_contain "< Access-Control-Expose-Headers: Content-Length" curl_output &&
65
+ test_should_contain "< Access-Control-Expose-Headers: X-Chunked-Output" curl_output &&
66
+ test_should_contain "< Access-Control-Expose-Headers: X-Stream-Output" curl_output &&
67
test_should_contain "< Access-Control-Expose-Headers: X-Ipfs-Path" curl_output &&
68
test_should_contain "< Access-Control-Expose-Headers: X-Ipfs-Roots" curl_output
69
'
70
71
+# HTTP OPTIONS Request on path → subdomain HTTP 301 redirect
72
+# (regression test for https://github.com/ipfs/kubo/issues/9983#issuecomment-1599673976)
73
+test_expect_success "OPTIONS to Gateway succeeds" '
74
+ curl -svX OPTIONS -H "Origin: https://example.com" "http://localhost:$GWAY_PORT/ipfs/$thash" 2>curl_output &&
75
+ cat curl_output
76
+'
77
+# OPTION Response from Gateway should contain CORS headers
78
+test_expect_success "OPTIONS response for subdomain redirect looks good" '
79
+ test_should_contain "HTTP/1.1 301 Moved Permanently" curl_output &&
80
+ test_should_contain "Location" curl_output &&
81
+ test_should_contain "< Access-Control-Allow-Origin: \*" curl_output &&
82
+ test_should_contain "< Access-Control-Allow-Methods: GET" curl_output
83
+'
84
+
85
test_kill_ipfs_daemon
86
87
# Test CORS safelisting of custom headers