@@ -362,37 +362,24 @@ func (s *Server) HandleSubdomain(middlewares ...func(http.Handler) http.Handler)
362362return
363363}
364364
365- // REVIEW: Like mentioned in coderd.go maybe we should extract the app
366- // using middleware that way we can do this in a single top-level CORS
367- // handler? Or just do the URL parsing twice.
368- var corsmw func (next http.Handler ) http.Handler
369- origin := r .Header .Get ("Origin" )
370- if originApp ,ok := s .parseOrigin (origin );ok && originApp .Username == app .Username {
371- corsmw = cors .Handler (cors.Options {
372- AllowedOrigins : []string {origin },
373- AllowedMethods : []string {
374- http .MethodHead ,
375- http .MethodGet ,
376- http .MethodPost ,
377- http .MethodPut ,
378- http .MethodPatch ,
379- http .MethodDelete ,
380- },
381- AllowedHeaders : []string {"*" },
382- AllowCredentials :true ,
383- })
384- }else {
385- corsmw = cors .Handler (cors.Options {
386- AllowedOrigins : []string {"" },// The middleware defaults to *.
387- AllowedMethods : []string {},
388- AllowedHeaders : []string {},
389- AllowCredentials :false ,
390- })
391- }
392-
393365// Use the passed in app middlewares before checking authentication and
394366// passing to the proxy app.
395- mws := chi .Middlewares (append (middlewares ,corsmw ))
367+ mws := chi .Middlewares (append (middlewares ,cors .Handler (cors.Options {
368+ AllowOriginFunc :func (r * http.Request ,origin string )bool {
369+ originApp ,ok := s .parseOrigin (origin )
370+ return ok && originApp .Username == app .Username
371+ },
372+ AllowedMethods : []string {
373+ http .MethodHead ,
374+ http .MethodGet ,
375+ http .MethodPost ,
376+ http .MethodPut ,
377+ http .MethodPatch ,
378+ http .MethodDelete ,
379+ },
380+ AllowedHeaders : []string {"*" },
381+ AllowCredentials :true ,
382+ })))
396383mws .Handler (http .HandlerFunc (func (rw http.ResponseWriter ,r * http.Request ) {
397384if ! s .handleAPIKeySmuggling (rw ,r ,AccessMethodSubdomain ) {
398385return