Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Only check for X-Frame-Options on provisioning url. Fixed bug with paths

  • Loading branch information...
commit 0d436e12b586e5d0ec725cea6c77fbb08e908aea 1 parent def21f4
@ozten ozten authored
Showing with 22 additions and 15 deletions.
  1. +22 −15 scripts/check_primary_support
View
37 scripts/check_primary_support
@@ -7,6 +7,7 @@
const
https = require('https'),
und = require('underscore'),
+urlp = require('url'),
util = require('util'),
primary = require('../lib/primary'),
@@ -29,8 +30,13 @@ primary.checkSupport(domain, function(err, urls, publicKey) {
console.log('Priary domain: ', domain);
console.log('Public Key: ', publicKey);
- getResource('auth', urls.auth, urls, function () {
- getResource('prov', urls.prov, urls);
+ var authopts = {
+ xframe: false
+ };
+ getResource('auth', urls.auth, urls, authopts, function () {
+ getResource('prov', urls.prov, urls, {
+ xframe: true
+ });
});
});
@@ -38,14 +44,14 @@ primary.checkSupport(domain, function(err, urls, publicKey) {
/**
* Retrieve one of their urls and examine aspects of it for issues
*/
-function getResource(mode, url, urls, cb) {
- console.log('Checking ', url);
+function getResource(mode, url, urls, opts, cb) {
+ var path = urlp.parse(url).path;
var body = "",
r = https.request({
host: domain,
- path: url,
+ path: path,
method: 'GET'
- }, checkResource(urls, body));
+ }, checkResource(url, opts, body));
r.on('data', function (chunk) {
body += chunk;
});
@@ -74,20 +80,21 @@ function getResource(mode, url, urls, cb) {
*
* Do the provisioning and signin resources look kosher?
*/
-function checkResource (urls, body) {
+function checkResource (url, opts, body) {
return function (resp) {
// Their are no X-Frame options
if (resp.statusCode != 200) {
- console.log("ERROR: HTTP status code=", resp.statusCode);
+ console.log("ERROR: HTTP status code=", resp.statusCode, url);
} else {
- var xframe = und.filter(Object.keys(resp.headers), function (header) {
- return header.toLowerCase() == 'x-frame-options';
- });
- if (xframe.length == 1) {
- console.log("ERROR: X-Frame-Options=", resp.headers[xframe[0]], ", BrowserID will not be able to communicate with your site." +
- " Suppress X-Frame-Options for /.well-known/browserid, " + urls.auth + ' and ' + urls.prov);
+ if (opts.xframe === true) {
+ var xframe = und.filter(Object.keys(resp.headers), function (header) {
+ return header.toLowerCase() == 'x-frame-options';
+ });
+ if (xframe.length == 1) {
+ console.log("ERROR: X-Frame-Options=", resp.headers[xframe[0]], ", BrowserID will not be able to communicate with your site." +
+ " Suppress X-Frame-Options for ", url);
+ }
}
-
resp.setEncoding('utf8');
}
};
Please sign in to comment.
Something went wrong with that request. Please try again.