fix: localhost API access via ipv6
This adds localhost ipv6 addresses to the allowlist for use in browser context and fixes WebUI on ipv6-only deployments: http://[::1]:5001/webui We were missing CORS/Origin tests for API port so I've added basic ones and included localhost/127.0.0.1/::1 variants.
Marcin Rataj committed
Oct 20, 2020 at 00:40 UTC
d1c20bdff75d96a72ee0fe004c01a606df933c23
4 files changed
+71
-7
core/corehttp/commands.go
+2
@@ -40,6 +40,8 @@ const APIPath = "/api/v0"
40
var defaultLocalhostOrigins = []string{
41
"http://127.0.0.1:<port>",
42
"https://127.0.0.1:<port>",
43
+ "http://[::1]:<port>",
44
+ "https://[::1]:<port>",
45
"http://localhost:<port>",
46
"https://localhost:<port>",
47
}
test/sharness/t0112-gateway-cors.sh
-7
@@ -6,16 +6,9 @@
6
7
test_description="Test HTTP Gateway CORS Support"
8
9
-test_config_ipfs_cors_headers() {
10
- ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin '["*"]'
11
- ipfs config --json API.HTTPHeaders.Access-Control-Allow-Methods '["PUT", "GET", "POST"]'
12
- ipfs config --json API.HTTPHeaders.Access-Control-Allow-Headers '["X-Requested-With"]'
13
-}
14
-
9
. lib/test-lib.sh
10
11
test_init_ipfs
18
-test_config_ipfs_cors_headers
12
test_launch_ipfs_daemon
13
14
thash='QmUNLLsPACCz1vLxQVkXqqLX5R1X345qqfHbsf67hvA3Nn'
test/sharness/t0400-api-no-gateway.sh
renamed
test/sharness/t0401-api-browser-security.sh
new
+69
@@ -0,0 +1,69 @@
1
+#!/usr/bin/env bash
2
+#
3
+# Copyright (c) 2020 Protocol Labs
4
+# MIT Licensed; see the LICENSE file in this repository.
5
+#
6
+
7
+test_description="Test API browser security"
8
+
9
+. lib/test-lib.sh
10
+
11
+test_init_ipfs
12
+
13
+PEERID=$(ipfs config Identity.PeerID)
14
+
15
+test_launch_ipfs_daemon
16
+
17
+test_expect_success "browser is unable to access API without Origin" '
18
+ curl -sD - -X POST -A "Mozilla" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output &&
19
+ grep "HTTP/1.1 403 Forbidden" curl_output
20
+'
21
+
22
+test_expect_success "browser is unable to access API with invalid Origin" '
23
+ curl -sD - -X POST -A "Mozilla" -H "Origin: https://invalid.example.com" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output &&
24
+ grep "HTTP/1.1 403 Forbidden" curl_output
25
+'
26
+
27
+test_expect_success "browser is able to access API if Origin is the API port on localhost (ipv4)" '
28
+ curl -sD - -X POST -A "Mozilla" -H "Origin: http://127.0.0.1:$API_PORT" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output &&
29
+ grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output
30
+'
31
+
32
+test_expect_success "browser is able to access API if Origin is the API port on localhost (ipv6)" '
33
+ curl -sD - -X POST -A "Mozilla" -H "Origin: http://[::1]:$API_PORT" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output &&
34
+ grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output
35
+'
36
+
37
+test_expect_success "browser is able to access API if Origin is the API port on localhost (localhost name)" '
38
+ curl -sD - -X POST -A "Mozilla" -H "Origin: http://localhost:$API_PORT" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output &&
39
+ grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output
40
+'
41
+
42
+test_kill_ipfs_daemon
43
+
44
+test_expect_success "setting CORS in API.HTTPHeaders works via CLI" "
45
+ ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin '[\"https://valid.example.com\"]' &&
46
+ ipfs config --json API.HTTPHeaders.Access-Control-Allow-Methods '[\"POST\"]' &&
47
+ ipfs config --json API.HTTPHeaders.Access-Control-Allow-Headers '[\"X-Requested-With\"]'
48
+"
49
+
50
+test_launch_ipfs_daemon
51
+
52
+# https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
53
+test_expect_success "OPTIONS with preflight request to API with CORS allowlist succeeds" '
54
+ curl -svX OPTIONS -A "Mozilla" -H "Origin: https://valid.example.com" -H "Access-Control-Request-Method: POST" -H "Access-Control-Request-Headers: origin, x-requested-with" "http://127.0.0.1:$API_PORT/api/v0/id" 2>curl_output &&
55
+ cat curl_output
56
+'
57
+
58
+# OPTION Response from Gateway should contain CORS headers, otherwise JS won't work
59
+test_expect_success "OPTIONS response for API with CORS allowslist looks good" '
60
+ grep "< Access-Control-Allow-Origin: https://valid.example.com" curl_output
61
+'
62
+
63
+test_expect_success "browser is able to access API with valid Origin matching CORS allowlist" '
64
+ curl -sD - -X POST -A "Mozilla" -H "Origin: https://valid.example.com" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output &&
65
+ grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output
66
+'
67
+
68
+test_kill_ipfs_daemon
69
+test_done