Fix origin check for server.

benwiley4000 · Mar 31, 2019 · 15eb9b6 · 15eb9b6
1 parent a1abc54
commit 15eb9b6
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 4 deletions.
diff --git a/lib/server.js b/lib/server.js
@@ -1,5 +1,4 @@
 const express = require('express')
-const url = require('url')
 const cors = require('cors')
 const bodyParser = require('body-parser')
 const HttpStatus = require('http-status-codes')
@@ -64,8 +63,8 @@ const createServer = (
   app.post('/', rootCorsMiddleware, (req, res, next) => {
     if (origin !== '*') {
       if (!req.headers.origin) return next(createError(403))
-      const { host, hostname } = url.parse(req.headers.origin)
-      if (host !== origin || hostname !== origin) return next(createError(403))
+      const originHeader = req.headers.origin
+      if (originHeader.indexOf(origin) === -1) return next(createError(403))
     }
     if (req.body && typeof req.body === 'string') {
       try {

diff --git a/test/server.spec.js b/test/server.spec.js
@@ -42,7 +42,7 @@ test('should send 403 when POSTING from a not allowed origin', async t => {
   try {
     await request.post(`${url}/`, {
       resolveWithFullResponse: true,
-      headers: { origin: 'another origin' }
+      headers: { origin: 'not that origin' }
     })
   } catch (e) {
     t.is(e.statusCode, 403)