diff options
Diffstat (limited to 'actioncable/lib/action_cable/connection/base.rb')
| -rw-r--r-- | actioncable/lib/action_cable/connection/base.rb | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/actioncable/lib/action_cable/connection/base.rb b/actioncable/lib/action_cable/connection/base.rb index 4c7fcc1434..76706a7465 100644 --- a/actioncable/lib/action_cable/connection/base.rb +++ b/actioncable/lib/action_cable/connection/base.rb @@ -195,8 +195,11 @@ module ActionCable def allow_request_origin? return true if server.config.disable_request_forgery_protection + proto = Rack::Request.new(env).ssl? ? "https" : "http" if Array(server.config.allowed_request_origins).any? { |allowed_origin| allowed_origin === env["HTTP_ORIGIN"] } true + elsif server.config.allow_same_origin_as_host && env["HTTP_ORIGIN"] == "#{proto}://#{env['HTTP_HOST']}" + true else logger.error("Request origin not allowed: #{env['HTTP_ORIGIN']}") false |