checkSameOrigin
checkSameOrigin
Description
Checks that request comes from the same origin. Extracts the Origin header value and verifies that allowed range
contains the obtained value. In the case of absent of the Origin header rejects with a MissingHeaderRejection.
If the origin value is not in the allowed range rejects with an InvalidOriginHeaderRejection
and StatusCodes.FORBIDDEN status.
Example
Checking the Origin header:
final HttpOrigin validOriginHeader =
HttpOrigin.create("http://localhost", Host.create("8080"));
final HttpOriginRange validOriginRange = HttpOriginRange.create(validOriginHeader);
final TestRoute route = testRoute(
checkSameOrigin(validOriginRange,
() -> complete("Result")));
route
.run(HttpRequest.create().addHeader(Origin.create(validOriginHeader)))
.assertStatusCode(StatusCodes.OK)
.assertEntity("Result");
route
.run(HttpRequest.create())
.assertStatusCode(StatusCodes.BAD_REQUEST);
final HttpOrigin invalidOriginHeader =
HttpOrigin.create("http://invalid.com", Host.create("8080"));
route
.run(HttpRequest.create().addHeader(Origin.create(invalidOriginHeader)))
.assertStatusCode(StatusCodes.FORBIDDEN);
Contents
