Merge pull request #270 from doringeman/cors

fix(cors): validate Origin header

Author: doringeman

pkg/middleware/cors.go

@@ -15,11 +15,6 @@ func CorsMiddleware(allowedOrigins []string, next http.Handler) http.Handler {
 		allowedOrigins = getAllowedOrigins()
 	}
 
-	// Explicitly disable all origins.
-	if allowedOrigins == nil {
-		return next
-	}
-
 	allowAll := len(allowedOrigins) == 1 && allowedOrigins[0] == "*"
 	allowedSet := make(map[string]struct{}, len(allowedOrigins))
 	for _, o := range allowedOrigins {
@@ -29,16 +24,23 @@ func CorsMiddleware(allowedOrigins []string, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		origin := r.Header.Get("Origin")
 
+		allowed := allowAll || originAllowed(origin, allowedSet)
+
+		if origin != "" && !allowed {
+			http.Error(w, "Origin not allowed", http.StatusForbidden)
+			return
+		}
+
 		// Set CORS headers if origin is allowed
-		if origin != "" && (allowAll || originAllowed(origin, allowedSet)) {
+		if origin != "" && allowed {
 			w.Header().Set("Access-Control-Allow-Origin", origin)
 		}
 
 		// Handle OPTIONS requests with origin validation.
 		// Only intercept OPTIONS if the origin is valid to prevent unauthorized preflight requests.
 		if r.Method == http.MethodOptions {
 			// Require valid Origin header for OPTIONS requests
-			if origin == "" || !(allowAll || originAllowed(origin, allowedSet)) {
+			if origin == "" || !allowed {
 				// No origin or invalid origin - pass to router for proper 405/404 response
 				next.ServeHTTP(w, r)
 				return

pkg/middleware/cors_test.go

@@ -38,7 +38,7 @@ func TestCorsMiddleware(t *testing.T) {
 			allowedOrigins: []string{"http://foo.com"},
 			method:         "GET",
 			origin:         "http://bar.com",
-			wantStatus:     http.StatusOK,
+			wantStatus:     http.StatusForbidden,
 			wantHeaders:    map[string]string{"Access-Control-Allow-Origin": ""},
 		},
 		{
@@ -74,7 +74,7 @@ func TestCorsMiddleware(t *testing.T) {
 			allowedOrigins: nil,
 			method:         "GET",
 			origin:         "http://foo.com",
-			wantStatus:     http.StatusOK,
+			wantStatus:     http.StatusForbidden,
 			wantHeaders:    map[string]string{"Access-Control-Allow-Origin": ""},
 		},
 	}