lowercase origin before checking cors

emicklei · Jun 4, 2022 · 9e49191 · 9e49191
1 parent 363acea
commit 9e49191
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/cors_filter.go b/cors_filter.go
@@ -132,16 +132,17 @@ func (c CrossOriginResourceSharing) isOriginAllowed(origin string) bool {
 	if len(origin) == 0 {
 		return false
 	}
+	lowerOrigin := strings.ToLower(origin)
 	if len(c.AllowedDomains) == 0 {
 		if c.AllowedDomainFunc != nil {
-			return c.AllowedDomainFunc(origin)
+			return c.AllowedDomainFunc(lowerOrigin)
 		}
 		return true
 	}
 
 	// exact match on each allowed domain
 	for _, domain := range c.AllowedDomains {
-		if domain == ".*" || domain == origin {
+		if domain == ".*" || strings.ToLower(domain) == lowerOrigin {
 			return true
 		}
 	}

diff --git a/cors_filter_test.go b/cors_filter_test.go
@@ -138,6 +138,9 @@ func TestCORSFilter_AllowedDomainFunc(t *testing.T) {
 	if got, want := cors.isOriginAllowed("here"), true; got != want {
 		t.Errorf("got [%v:%T] want [%v:%T]", got, got, want, want)
 	}
+	if got, want := cors.isOriginAllowed("HERE"), true; got != want {
+		t.Errorf("got [%v:%T] want [%v:%T]", got, got, want, want)
+	}
 	if got, want := cors.isOriginAllowed("there"), true; got != want {
 		t.Errorf("got [%v:%T] want [%v:%T]", got, got, want, want)
 	}