feat: Allow * in allowed_origins. #2370 (#2382)

h2oai · Aug 13, 2024 · 4d6e4be · 4d6e4be
1 parent 6ebfbf9
commit 4d6e4be
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 4 deletions.
diff --git a/conf.go b/conf.go
@@ -115,5 +115,5 @@ type Conf struct {
  KeepAppLive bool `cfg:"keep-app-live" env:"H2O_WAVE_KEEP_APP_LIVE" cfgDefault:"false" cfgHelper:"do not unregister unresponsive apps"`
  Conf string `cfg:"conf" env:"H2O_WAVE_CONF" cfgDefault:".env" cfgHelper:"path to configuration file"`
  ReconnectTimeout string `cfg:"reconnect-timeout" env:"H2O_WAVE_RECONNECT_TIMEOUT" cfgDefault:"5s" cfgHelper:"Time to wait for reconnect before dropping the client"`
- AllowedOrigins string `cfg:"allowed-origins" env:"H2O_WAVE_ALLOWED_ORIGINS" cfgDefault:"" cfgHelper:"comma-separated list of allowed origins (e.g. http://foo.com) for websocket upgrades"`
+ AllowedOrigins string `cfg:"allowed-origins" env:"H2O_WAVE_ALLOWED_ORIGINS" cfgDefault:"" cfgHelper:"comma-separated list of allowed origins (e.g. http://foo.com) for websocket upgrades, use '*' to allow all origins"`
 }
diff --git a/socket.go b/socket.go
@@ -37,9 +37,9 @@ type SocketServer struct {
 
 func newSocketServer(broker *Broker, auth *Auth, conf ServerConf) *SocketServer {
  var checkOrigin func(*http.Request) bool
- if conf.AllowedOrigins != nil {
+ if len(conf.AllowedOrigins) != 0 {
  checkOrigin = func(r *http.Request) bool {
- return conf.AllowedOrigins[r.Header.Get("Origin")]
+ return conf.AllowedOrigins["*"] || conf.AllowedOrigins[r.Header.Get("Origin")]
  }
  }
  upgrader := websocket.Upgrader{

diff --git a/website/docs/configuration.md b/website/docs/configuration.md
@@ -60,9 +60,10 @@ Wave can be configured via configuration (`.env`) file, environment variables or
 | H2O_WAVE_CONF | -conf string | path to a configuration file (default ".env") |
 | H2O_WAVE_PING_INTERVAL | -ping-interval string | how often should ping messages be sent (e.g. 60s or 1m or 0.1h) to keep the websocket connection alive (default "50s") |
 | H2O_WAVE_RECONNECT_TIMEOUT | -reconnect-timeout string | Time to wait for reconnect before dropping the client (default "2s") |
-| H2O_WAVE_ALLOWED_ORIGINS | -allowed-origins string | comma-separated list of allowed origins (e.g. http://foo.com) for websocket upgrades  |
+| H2O_WAVE_ALLOWED_ORIGINS | -allowed-origins string | comma-separated list of allowed origins (e.g. http://foo.com) for websocket upgrades, use `*` to allow all origins |
 
 [^1]: `1`, `t`, `true` to enable; `0`, `f`, `false` to disable (case insensitive).
+
 [^2]: Use OS-specific path list separator to specify multiple arguments - `:` for Linux/OSX and `;` for Windows. For example, `H2O_WAVE_PUBLIC_DIR=/images/@./files/images:/downloads/@./files/downloads`.
 
 ### File paths