fix(server): fix header check for socket server #2077
Conversation
Codecov Report
@@ Coverage Diff @@
## master #2077 +/- ##
==========================================
+ Coverage 92.92% 93.27% +0.35%
==========================================
Files 32 32
Lines 1201 1205 +4
Branches 335 333 -2
==========================================
+ Hits 1116 1124 +8
+ Misses 81 77 -4
Partials 4 4
Continue to review full report at Codecov.
|
| }); | ||
| } | ||
|
|
||
| onConnectionClose(connection, f) { |
There was a problem hiding this comment.
@evilebottnawi As I say later, I want to not assume anything about the connection object. Probably most connection objects will work like connection.on('close', f), which is the case with both sockjs and ws. But maybe some other library implements it like connection.onclose = f.
| onConnection(f) { | ||
| this.socket.on('connection', f); | ||
| this.socket.on('connection', (connection) => { | ||
| f(connection, connection.headers); |
There was a problem hiding this comment.
Why not use only connection?
There was a problem hiding this comment.
@evilebottnawi Because ws connection object does not work the same, it does not have a headers property (https://github.com/webpack/webpack-dev-server/pull/2077/files#diff-b111fb9e1bc06a00edb8d0416cabf86dR33). The goal is to not assume anything about the connection object, since it could differ between socket server types.
| @@ -677,25 +677,22 @@ class Server { | |||
| const SocketServerImplementation = this.socketServerImplementation; | |||
| this.socketServer = new SocketServerImplementation(this); | |||
|
|
|||
| this.socketServer.onConnection((connection) => { | |||
| this.socketServer.onConnection((connection, headers) => { | |||
There was a problem hiding this comment.
connection already has headers, i think we don't need extra argument
|
/cc @hiroppy |
|
/cc @evilebottnawi @hiroppy please review this first because it is needed for |
|
/cc @hiroppy feel free to merge when CI green, i am on mobile |
| !this.checkHost(connection.headers) || | ||
| !this.checkOrigin(connection.headers) | ||
| ) { | ||
| if (headers && (!this.checkHost(headers) || !this.checkOrigin(headers))) { |
There was a problem hiding this comment.
This looks like it's too easy to accidentally skip the security check.
Maybe changing it to if (!headers || ...
There was a problem hiding this comment.
@sokra Good point. I think if users do not implement onConnection correctly though, it will be hard to figure out what is wrong. Maybe before that I'll log a warning if headers are missing.
There was a problem hiding this comment.
@Loonride it should be no warning, we should drop connection if headers are not present
There was a problem hiding this comment.
@evilebottnawi If !headers is true it means that the user made a socket server implementation that did not call the onConnection(f) callback correctly, so I think that could cause confusion if there is little explanation for failed connection. Let me send a PR and I'll show you what I mean
|
/cc @Loonride |
* fix(server): fix header check for socket server * test(server): tests to check header error and server methods
For Bugs and Features; did you add new tests?
Not yet
Motivation / Use-Case
Headers are not passed in the same way on connection for
wsandsockjs, so the socket server implementation needs to reflect that, then the server can check the headers.Breaking Changes
None
Additional Info