fix: allow ipfs-companion browser extension to access RPC API (#8690)
* fix: add companion ids to allow origins - fixes #8689 - Adds the chrome-extension ids for ipfs-companion and ipfs-companion-beta to the allowed origins list, this allows us to accesss ipfs api from a manifest v3 extension. - added tests in t0401-api-browser-security.sh * fix: companion when custom CORS *-Origin is set Companion extension should be able to access RPC API even when custom Access-Control-Allow-Origin is set Co-authored-by: Marcin Rataj <lidel@lidel.org>
Dave Justice committed
Mar 16, 2022 at 19:07 UTC
6774ef9dfdd5aa1e7b34cdd048cb8efedee4e305
2 files changed
+32
-4
core/corehttp/commands.go
+8
-4
@@ -46,6 +46,11 @@ var defaultLocalhostOrigins = []string{
46
"https://localhost:<port>",
47
}
48
49
+var companionBrowserExtensionOrigins = []string{
50
+ "chrome-extension://nibjojkomfdiaoajekhjakgkdhaomnch", // ipfs-companion
51
+ "chrome-extension://hjoieblefckbooibpepigmacodalfndh", // ipfs-companion-beta
52
+}
53
+
54
func addCORSFromEnv(c *cmdsHttp.ServerConfig) {
55
origin := os.Getenv(originEnvKey)
56
if origin != "" {
@@ -84,10 +89,9 @@ func addHeadersFromConfig(c *cmdsHttp.ServerConfig, nc *config.Config) {
89
}
90
91
func addCORSDefaults(c *cmdsHttp.ServerConfig) {
87
- // by default use localhost origins
88
- if len(c.AllowedOrigins()) == 0 {
89
- c.SetAllowedOrigins(defaultLocalhostOrigins...)
90
- }
92
+ // always safelist certain origins
93
+ c.AppendAllowedOrigins(defaultLocalhostOrigins...)
94
+ c.AppendAllowedOrigins(companionBrowserExtensionOrigins...)
95
96
// by default, use GET, PUT, POST
97
if len(c.AllowedMethods()) == 0 {
test/sharness/t0401-api-browser-security.sh
+24
@@ -39,6 +39,22 @@ test_expect_success "browser is able to access API if Origin is the API port on
39
grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output
40
'
41
42
+test_expect_success "Random browser extension is unable to access RPC API due to invalid Origin" '
43
+ curl -sD - -X POST -A "Mozilla" -H "Origin: chrome-extension://invalidextensionid" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output &&
44
+ grep "HTTP/1.1 403 Forbidden" curl_output
45
+'
46
+
47
+test_expect_success "Companion extension is able to access RPC API on localhost" '
48
+ curl -sD - -X POST -A "Mozilla" -H "Origin: chrome-extension://nibjojkomfdiaoajekhjakgkdhaomnch" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output &&
49
+ cat curl_output &&
50
+ grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output
51
+'
52
+
53
+test_expect_success "Companion beta extension is able to access API on localhost" '
54
+ curl -sD - -X POST -A "Mozilla" -H "Origin: chrome-extension://hjoieblefckbooibpepigmacodalfndh" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output &&
55
+ grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output
56
+'
57
+
58
test_kill_ipfs_daemon
59
60
test_expect_success "setting CORS in API.HTTPHeaders works via CLI" "
@@ -49,6 +65,14 @@ test_expect_success "setting CORS in API.HTTPHeaders works via CLI" "
65
66
test_launch_ipfs_daemon
67
68
+test_expect_success "Companion extension is able to access RPC API even when custom Access-Control-Allow-Origin is set" '
69
+ ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin | grep -q valid.example.com &&
70
+ curl -sD - -X POST -A "Mozilla" -H "Origin: chrome-extension://nibjojkomfdiaoajekhjakgkdhaomnch" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output &&
71
+ cat curl_output &&
72
+ grep "HTTP/1.1 200 OK" curl_output &&
73
+ grep "$PEERID" curl_output
74
+'
75
+
76
# https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
77
test_expect_success "OPTIONS with preflight request to API with CORS allowlist succeeds" '
78
curl -svX OPTIONS -A "Mozilla" -H "Origin: https://valid.example.com" -H "Access-Control-Request-Method: POST" -H "Access-Control-Request-Headers: origin, x-requested-with" "http://127.0.0.1:$API_PORT/api/v0/id" 2>curl_output &&