cmd: Set Origin header properly on API requests

Ref. https://caddy.community/t/bug-in-enforce-origin/15417

Matthew Holt committed Mar 19, 2022 at 22:51 UTC c2327161f725c820826587381f37d651a2b9736d

1 file changed +2 -2

cmd/commandfuncs.go

+2 -2

@@ -650,13 +650,13 @@ func AdminAPIRequest(adminAddr, method, uri string, headers http.Header, body io

650 if err != nil || parsedAddr.PortRangeSize() > 1 {

651 return nil, fmt.Errorf("invalid admin address %s: %v", adminAddr, err)

652 }

653 - origin := parsedAddr.JoinHostPort(0)

653 + origin := "http://" + parsedAddr.JoinHostPort(0)

654 if parsedAddr.IsUnixNetwork() {

655 origin = "unixsocket" // hack so that http.NewRequest() is happy

656 }

657

658 // form the request

659 - req, err := http.NewRequest(method, "http://"+origin+uri, body)

659 + req, err := http.NewRequest(method, origin+uri, body)

660 if err != nil {

661 return nil, fmt.Errorf("making request: %v", err)

662 }