Please add Origin Header information on WebSocket

[akoliya003]

For security GraphQL Server also does origin check so request header should have origin information.

Below is the line# which is working on local copy.

GraphQL.Client -->Websocket-->GraphQLHttpWebSocket.cs

Appreciate your quick help on this.

#if NETFRAMEWORK
// fix websocket not supported on win 7 using
// https://github.com/PingmanTools/System.Net.WebSockets.Client.Managed
clientWebSocket = SystemClientWebSocket.CreateClientWebSocket();
switch (clientWebSocket) {
case ClientWebSocket nativeWebSocket:
nativeWebSocket.Options.AddSubProtocol("graphql-ws");
nativeWebSocket.Options.SetRequestHeader("Origin", webSocketUri.Host);
nativeWebSocket.Options.ClientCertificates = ((HttpClientHandler)Options.HttpMessageHandler).ClientCertificates;
nativeWebSocket.Options.UseDefaultCredentials = ((HttpClientHandler)Options.HttpMessageHandler).UseDefaultCredentials;
break;
case System.Net.WebSockets.Managed.ClientWebSocket managedWebSocket:
managedWebSocket.Options.AddSubProtocol("graphql-ws");
managedWebSocket.Options.SetRequestHeader("Origin", webSocketUri.Host);
managedWebSocket.Options.ClientCertificates = ((HttpClientHandler)Options.HttpMessageHandler).ClientCertificates;
managedWebSocket.Options.UseDefaultCredentials = ((HttpClientHandler)Options.HttpMessageHandler).UseDefaultCredentials;
break;
default:
throw new NotSupportedException($"unknown websocket type {clientWebSocket.GetType().Name}");
}
#else
clientWebSocket = new ClientWebSocket();
clientWebSocket.Options.AddSubProtocol("graphql-ws");
clientWebSocket.Options.SetRequestHeader("Origin", webSocketUri.Host);
clientWebSocket.Options.ClientCertificates = ((HttpClientHandler)Options.HttpMessageHandler).ClientCertificates;
clientWebSocket.Options.UseDefaultCredentials = ((HttpClientHandler)Options.HttpMessageHandler).UseDefaultCredentials;
#endif

[rose-a]

I don't think it is safe to assume that setting the origin header to the host part of the websocket uri is the behaviour everyone wants (looks like there is no fixed spec on how this header MUST be used).

We could propably add a corresponding field to GraphQLHttpClientOptions though...

[akoliya003]

Hi Alexander, Thanks for your prompt reply on this. Appreciate your help. Please let me know the version# once it is fixed. Thanks, Bhavesh

…

On Wed, Mar 4, 2020 at 7:39 AM Alexander Rose ***@***.***> wrote: I don't think it is safe to assume that setting the origin header to the host part of the websocket uri is the behaviour everyone wants (looks like there is no fixed spec on how this header MUST be used). We could propably add a corresponding field to GraphQLHttpClientOptions though... — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#179?email_source=notifications&email_token=AIYRHNBC5PGHP25DYFTHCGDRFZKY3A5CNFSM4LAVWOS2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOENX4NKQ#issuecomment-594527914>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AIYRHNHZTM7WB4YXHUAW7KDRFZKY3ANCNFSM4LAVWOSQ> .