aboutsummaryrefslogtreecommitdiffstats
path: root/actioncable/test
diff options
context:
space:
mode:
authorDávid Halász <dhalasz@redhat.com>2016-09-21 14:55:25 +0200
committerDávid Halász <dhalasz@redhat.com>2016-09-21 16:10:46 +0200
commit268c340b0909bd78259e58b1ed0b53133d924199 (patch)
tree547d9bbf49af12fd29da581f3baa7cec8fa591e4 /actioncable/test
parent19966242163611e61d45ee4033f28aa6f967906a (diff)
downloadrails-268c340b0909bd78259e58b1ed0b53133d924199.tar.gz
rails-268c340b0909bd78259e58b1ed0b53133d924199.tar.bz2
rails-268c340b0909bd78259e58b1ed0b53133d924199.zip
Optionally allow ActionCable requests from the same host as origin
When the `allow_same_origin_as_host` is set to `true`, the request forgery protection permits `HTTP_ORIGIN` values starting with the corresponding `proto://` prefix followed by `HTTP_HOST`. This way it is not required to specify the list of allowed URLs.
Diffstat (limited to 'actioncable/test')
-rw-r--r--actioncable/test/connection/cross_site_forgery_test.rb8
1 files changed, 8 insertions, 0 deletions
diff --git a/actioncable/test/connection/cross_site_forgery_test.rb b/actioncable/test/connection/cross_site_forgery_test.rb
index 3bc59c9db9..6cabff5440 100644
--- a/actioncable/test/connection/cross_site_forgery_test.rb
+++ b/actioncable/test/connection/cross_site_forgery_test.rb
@@ -18,6 +18,7 @@ class ActionCable::Connection::CrossSiteForgeryTest < ActionCable::TestCase
teardown do
@server.config.disable_request_forgery_protection = false
@server.config.allowed_request_origins = []
+ @server.config.allow_same_origin_as_host = false
end
test "disable forgery protection" do
@@ -53,6 +54,13 @@ class ActionCable::Connection::CrossSiteForgeryTest < ActionCable::TestCase
assert_origin_not_allowed "http://rails.co.uk"
end
+ test "allow same origin as host" do
+ @server.config.allow_same_origin_as_host = true
+ assert_origin_allowed "http://#{HOST}"
+ assert_origin_not_allowed "http://hax.com"
+ assert_origin_not_allowed "http://rails.co.uk"
+ end
+
private
def assert_origin_allowed(origin)
response = connect_with_origin origin