Add same origin support to SockJS and WebSocket [SPR-12697]

[spring-projects-issues]

Sébastien Deleuze opened SPR-12697 and commented

Simplified support for "same origin" requests for SockJS and WebSocket makes sense for a lot of use cases. But we can't just rely on the lack of Origin header to identify same origin requests, since for example Chrome provides it even for same origin AJAX requests.

As proposed by Rob Winch, we should support a smart "same origin" check that compares Origin header to Host header. A possible implementation is available in this Gist. This check should be added to both AbstractSockJSService and OriginHandshakeInterceptor.

You can see the impact on supported browsers when this mode is enabled in this browser support matrix.

---

Reference URL: https://gist.github.com/sdeleuze/a522ef9096b03737e553

Issue Links:

• Change SockJS default to allowing same origin only [SPR-12685] #17284 Change SockJS default to allowing same origin only ("is depended on by")
• AbstractSockJsService.checkAndAddCorsHeaders fails for same origin requests when setAllowedOrigins is set [SPR-12660] #17260 AbstractSockJsService.checkAndAddCorsHeaders fails for same origin requests when setAllowedOrigins is set