diff options
Diffstat (limited to 'actioncable/lib')
| -rw-r--r-- | actioncable/lib/action_cable/connection/base.rb | 4 | ||||
| -rw-r--r-- | actioncable/lib/action_cable/server/configuration.rb | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/actioncable/lib/action_cable/connection/base.rb b/actioncable/lib/action_cable/connection/base.rb index 2596635701..dfee123ea2 100644 --- a/actioncable/lib/action_cable/connection/base.rb +++ b/actioncable/lib/action_cable/connection/base.rb @@ -196,9 +196,9 @@ module ActionCable return true if server.config.disable_request_forgery_protection proto = Rack::Request.new(env).ssl? ? "https" : "http" - if Array(server.config.allowed_request_origins).any? { |allowed_origin| allowed_origin === env["HTTP_ORIGIN"] } + if server.config.allow_same_origin_as_host && env["HTTP_ORIGIN"] == "#{proto}://#{env['HTTP_HOST']}" true - elsif server.config.allow_same_origin_as_host && env["HTTP_ORIGIN"] == "#{proto}://#{env['HTTP_HOST']}" + elsif Array(server.config.allowed_request_origins).any? { |allowed_origin| allowed_origin === env["HTTP_ORIGIN"] } true else logger.error("Request origin not allowed: #{env['HTTP_ORIGIN']}") diff --git a/actioncable/lib/action_cable/server/configuration.rb b/actioncable/lib/action_cable/server/configuration.rb index aa8d10b3d4..17e0dee064 100644 --- a/actioncable/lib/action_cable/server/configuration.rb +++ b/actioncable/lib/action_cable/server/configuration.rb @@ -15,7 +15,7 @@ module ActionCable @worker_pool_size = 4 @disable_request_forgery_protection = false - @allow_same_origin_as_host = false + @allow_same_origin_as_host = true end # Returns constant of subscription adapter specified in config/cable.yml. |