cmds/http: remove referrer check
it used to be here for a CSRF check. but we now have CORS checks. License: MIT Signed-off-by: Juan Batiz-Benet <juan@benet.ai>
Juan Batiz-Benet committed
Jul 28, 2015 at 07:20 UTC
c633e2b575e9a27c52139d5c6a717dae2f73b8fe
1 file changed
-14
commands/http/handler.go
-14
@@ -102,20 +102,6 @@ func (i Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
102
func (i internalHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
103
log.Debug("Incoming API request: ", r.URL)
104
105
- // error on external referers (to prevent CSRF attacks)
106
- referer := r.Referer()
107
- scheme := r.URL.Scheme
108
- if len(scheme) == 0 {
109
- scheme = "http"
110
- }
111
- host := fmt.Sprintf("%s://%s/", scheme, r.Host)
112
- // empty string means the user isn't following a link (they are directly typing in the url)
113
- if referer != "" && !strings.HasPrefix(referer, host) {
114
- w.WriteHeader(http.StatusForbidden)
115
- w.Write([]byte("403 - Forbidden"))
116
- return
117
- }
118
-
105
req, err := Parse(r, i.root)
106
if err != nil {
107
if err == ErrNotFound {