Skip to content

Commit 2945342

Browse files
NickMRamirezNickMRamirez
committed
This version depends on HAProxy 2.2, but allows the Lua action to reply directly to a CORS preflight request.
1 parent 83cdc7c commit 2945342

File tree

4 files changed

+173
-72
lines changed

4 files changed

+173
-72
lines changed

‎example/docker-compose.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ services:
1010
- "name=server1"
1111

1212
haproxy:
13-
image: haproxytech/haproxy-ubuntu:2.0
13+
image: haproxytech/haproxy-ubuntu:2.2
1414
volumes:
1515
- "./haproxy/haproxy.cfg:/etc/haproxy/haproxy.cfg"
1616
- "./haproxy/cors.lua:/etc/haproxy/cors.lua"

‎example/haproxy/cors.lua‎

Lines changed: 87 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -20,59 +20,112 @@ function contains(items, test_str)
2020
return false
2121
end
2222

23-
-- When invoked during a request, captures the Origin header if present
24-
-- and stores it in a private variable.
25-
function cors_request(txn)
26-
local headers = txn.http:req_get_headers()
27-
local origin = headers["origin"]
28-
23+
-- If the given origin is found within the allowed_origins string, it is returned. Otherwise, nil is returned.
24+
-- origin: The value from the 'origin' request header
25+
-- allowed_methods: Comma-delimited list of allowed HTTP methods. (e.g. GET,POST,PUT,DELETE)
26+
function get_allowed_origin(origin, allowed_origins)
2927
if origin ~= nil then
30-
core.Debug("CORS: Got 'Origin' header: " .. headers["origin"][0])
31-
txn:set_priv(headers["origin"][0])
28+
local allowed_origins = core.tokenize(allowed_origins, ",")
29+
30+
-- Strip whitespace
31+
for index, value in ipairs(allowed_origins) do
32+
allowed_origins[index] = value:gsub("%s+", "")
33+
end
34+
35+
core.Debug("CORS - Origin: " .. origin)
36+
37+
if contains(allowed_origins, "*") then
38+
return "*"
39+
elseif contains(allowed_origins, origin:match("//([^/]+)")) then
40+
return origin
41+
end
3242
end
43+
44+
return nil
3345
end
3446

35-
-- When invoked during a response, sets CORS headers so that the browser
36-
-- can read the response from permitted domains.
37-
-- txn: The current transaction object that gives access to response properties.
47+
-- Add headers for CORS preflight request and then returns a 204 response.
48+
-- txn: The current transaction object that gives access to response properties
49+
-- method: The HTTP method
50+
-- origin: The value from the 'origin' request header
51+
-- allowed_methods: Comma-delimited list of allowed HTTP methods. (e.g. GET,POST,PUT,DELETE)
52+
-- allowed_origins: Comma-delimited list of allowed origins. (e.g. localhost,localhost:8080,test.com)
53+
function preflight_request(txn, method, origin, allowed_methods, allowed_origins)
54+
core.Debug("CORS: preflight request OPTIONS")
55+
56+
-- NOTE: The 'reply' function is available in HAProxy 2.2+
57+
local reply = txn:reply()
58+
reply:set_status(204, "No Content")
59+
reply:add_header("Content-Type", "text/html")
60+
reply:add_header("Access-Control-Allow-Methods", allowed_methods)
61+
reply:add_header("Access-Control-Max-Age", 600)
62+
63+
local allowed_origin = get_allowed_origin(origin, allowed_origins)
64+
65+
if allowed_origin == nil then
66+
core.Debug("CORS: " .. origin .. " not allowed")
67+
else
68+
core.Debug("CORS: " .. origin .. " allowed")
69+
reply:add_header("Access-Control-Allow-Origin", allowed_origin)
70+
end
71+
72+
core.Debug("CORS: Returning reply to CORS preflight request")
73+
txn:done(reply)
74+
end
75+
76+
-- When invoked during a request, captures the origin header if present and stores it in a private variable.
77+
-- If the request is OPTIONS, returns a preflight request reply.
78+
-- txn: The current transaction object that gives access to response properties
3879
-- allowed_methods: Comma-delimited list of allowed HTTP methods. (e.g. GET,POST,PUT,DELETE)
3980
-- allowed_origins: Comma-delimited list of allowed origins. (e.g. localhost,localhost:8080,test.com)
40-
function cors_response(txn, allowed_methods, allowed_origins)
81+
function cors_request(txn, allowed_methods, allowed_origins)
82+
local headers = txn.http:req_get_headers()
83+
local origin = headers["origin"][0]
84+
85+
local transaction_data = {}
86+
87+
if origin ~= nil then
88+
core.Debug("CORS: Got 'Origin' header: " .. headers["origin"][0])
89+
transaction_data["origin"] = origin
90+
end
91+
92+
transaction_data["allowed_methods"] = allowed_methods
93+
transaction_data["allowed_origins"] = allowed_origins
94+
95+
txn:set_priv(transaction_data)
96+
4197
local method = txn.sf:method()
42-
local origin = txn:get_priv()
4398

44-
-- add headers for CORS preflight request
4599
if method == "OPTIONS" then
46-
core.Debug("CORS: preflight request OPTIONS")
47-
txn.http:res_add_header("Access-Control-Allow-Methods", allowed_methods)
48-
txn.http:res_set_header("Allow", allowed_methods)
49-
txn.http:res_add_header("Access-Control-Max-Age", 600)
100+
preflight_request(txn, method, origin, allowed_methods, allowed_origins)
50101
end
102+
end
103+
104+
-- When invoked during a response, sets CORS headers so that the browser can read the response from permitted domains.
105+
-- txn: The current transaction object that gives access to response properties.
106+
function cors_response(txn)
107+
local transaction_data = txn:get_priv()
108+
local origin = transaction_data["origin"]
109+
local allowed_origins = transaction_data["allowed_origins"]
110+
111+
-- Always vary on the Origin
112+
txn.http:res_add_header("Vary", "Accept-Encoding,Origin")
51113

52114
-- Bail if client did not send an Origin
53115
if origin == nil or origin == '' then
54116
return
55117
end
56118

57-
local allowed_origins = core.tokenize(allowed_origins, ",")
58-
59-
-- Strip whitespace
60-
for index, value in ipairs(allowed_origins) do
61-
allowed_origins[index] = value:gsub("%s+", "")
62-
end
119+
local allowed_origin = get_allowed_origin(origin, allowed_origins)
63120

64-
if contains(allowed_origins, "*") then
65-
core.Debug("CORS: " .. "* allowed")
66-
txn.http:res_add_header("Access-Control-Allow-Origin", "*")
67-
elseif contains(allowed_origins, origin:match("//([^/]+)")) then
68-
core.Debug("CORS: " .. origin .. " allowed")
69-
txn.http:res_add_header("Access-Control-Allow-Origin", origin)
70-
txn.http:res_add_header("Vary", "Accept-Encoding,Origin")
71-
else
121+
if allowed_origin == nil then
72122
core.Debug("CORS: " .. origin .. " not allowed")
123+
else
124+
core.Debug("CORS: " .. origin .. " allowed")
125+
txn.http:res_add_header("Access-Control-Allow-Origin", allowed_origin)
73126
end
74127
end
75128

76129
-- Register the actions with HAProxy
77-
core.register_action("cors", {"http-req"}, cors_request, 0)
78-
core.register_action("cors", {"http-res"}, cors_response, 2)
130+
core.register_action("cors", {"http-req"}, cors_request, 2)
131+
core.register_action("cors", {"http-res"}, cors_response, 0)

‎example/haproxy/haproxy.cfg‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ listen api
1919
bind :8080
2020

2121
# Invoke the CORS service on the request to capture the Origin header
22-
http-request lua.cors
22+
http-request lua.cors "GET,PUT,POST", "localhost"
2323

2424
# Invoke the CORS service on the response to add CORS headers
25-
http-response lua.cors "GET,PUT,POST" "localhost"
25+
http-response lua.cors
2626
server s1 server1:80 check

‎lib/cors.lua‎

Lines changed: 83 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -20,35 +20,93 @@ function contains(items, test_str)
2020
return false
2121
end
2222

23-
-- When invoked during a request, captures the Origin header if present
24-
-- and stores it in a private variable.
25-
function cors_request(txn)
23+
-- If the given origin is found within the allowed_origins string, it is returned. Otherwise, nil is returned.
24+
-- origin: The value from the 'origin' request header
25+
-- allowed_methods: Comma-delimited list of allowed HTTP methods. (e.g. GET,POST,PUT,DELETE)
26+
function get_allowed_origin(origin, allowed_origins)
27+
if origin ~= nil then
28+
local allowed_origins = core.tokenize(allowed_origins, ",")
29+
30+
-- Strip whitespace
31+
for index, value in ipairs(allowed_origins) do
32+
allowed_origins[index] = value:gsub("%s+", "")
33+
end
34+
35+
core.Debug("CORS - Origin: " .. origin)
36+
37+
if contains(allowed_origins, "*") then
38+
return "*"
39+
elseif contains(allowed_origins, origin:match("//([^/]+)")) then
40+
return origin
41+
end
42+
end
43+
44+
return nil
45+
end
46+
47+
-- Add headers for CORS preflight request and then returns a 204 response.
48+
-- txn: The current transaction object that gives access to response properties
49+
-- method: The HTTP method
50+
-- origin: The value from the 'origin' request header
51+
-- allowed_methods: Comma-delimited list of allowed HTTP methods. (e.g. GET,POST,PUT,DELETE)
52+
-- allowed_origins: Comma-delimited list of allowed origins. (e.g. localhost,localhost:8080,test.com)
53+
function preflight_request(txn, method, origin, allowed_methods, allowed_origins)
54+
core.Debug("CORS: preflight request OPTIONS")
55+
56+
-- NOTE: The 'reply' function is available in HAProxy 2.2+
57+
local reply = txn:reply()
58+
reply:set_status(204, "No Content")
59+
reply:add_header("Content-Type", "text/html")
60+
reply:add_header("Access-Control-Allow-Methods", allowed_methods)
61+
reply:add_header("Access-Control-Max-Age", 600)
62+
63+
local allowed_origin = get_allowed_origin(origin, allowed_origins)
64+
65+
if allowed_origin == nil then
66+
core.Debug("CORS: " .. origin .. " not allowed")
67+
else
68+
core.Debug("CORS: " .. origin .. " allowed")
69+
reply:add_header("Access-Control-Allow-Origin", allowed_origin)
70+
end
71+
72+
core.Debug("CORS: Returning reply to CORS preflight request")
73+
txn:done(reply)
74+
end
75+
76+
-- When invoked during a request, captures the origin header if present and stores it in a private variable.
77+
-- If the request is OPTIONS, returns a preflight request reply.
78+
-- txn: The current transaction object that gives access to response properties
79+
-- allowed_methods: Comma-delimited list of allowed HTTP methods. (e.g. GET,POST,PUT,DELETE)
80+
-- allowed_origins: Comma-delimited list of allowed origins. (e.g. localhost,localhost:8080,test.com)
81+
function cors_request(txn, allowed_methods, allowed_origins)
2682
local headers = txn.http:req_get_headers()
27-
local origin = headers["origin"]
83+
local origin = headers["origin"][0]
84+
85+
local transaction_data = {}
2886

2987
if origin ~= nil then
3088
core.Debug("CORS: Got 'Origin' header: " .. headers["origin"][0])
31-
txn:set_priv(headers["origin"][0])
89+
transaction_data["origin"] = origin
3290
end
33-
end
3491

35-
-- Add headers for CORS preflight request
36-
function preflight_request(txn, method, allowed_methods)
92+
transaction_data["allowed_methods"] = allowed_methods
93+
transaction_data["allowed_origins"] = allowed_origins
94+
95+
txn:set_priv(transaction_data)
96+
97+
local method = txn.sf:method()
98+
3799
if method == "OPTIONS" then
38-
core.Debug("CORS: preflight request OPTIONS")
39-
txn.http:res_add_header("Access-Control-Allow-Methods", allowed_methods)
40-
txn.http:res_add_header("Access-Control-Max-Age", 600)
100+
preflight_request(txn, method, origin, allowed_methods, allowed_origins)
41101
end
42102
end
43103

44-
-- When invoked during a response, sets CORS headers so that the browser
45-
-- can read the response from permitted domains.
104+
-- When invoked during a response, sets CORS headers so that the browser can read the response from permitted domains.
46105
-- txn: The current transaction object that gives access to response properties.
47-
-- allowed_methods: Comma-delimited list of allowed HTTP methods. (e.g. GET,POST,PUT,DELETE)
48-
-- allowed_origins: Comma-delimited list of allowed origins. (e.g. localhost,localhost:8080,test.com)
49-
function cors_response(txn, allowed_methods, allowed_origins)
50-
local method = txn.sf:method()
51-
local origin = txn:get_priv()
106+
function cors_response(txn)
107+
local transaction_data = txn:get_priv()
108+
local origin = transaction_data["origin"]
109+
local allowed_origins = transaction_data["allowed_origins"]
52110

53111
-- Always vary on the Origin
54112
txn.http:res_add_header("Vary", "Accept-Encoding,Origin")
@@ -58,26 +116,16 @@ function cors_response(txn, allowed_methods, allowed_origins)
58116
return
59117
end
60118

61-
local allowed_origins = core.tokenize(allowed_origins, ",")
62-
63-
-- Strip whitespace
64-
for index, value in ipairs(allowed_origins) do
65-
allowed_origins[index] = value:gsub("%s+", "")
66-
end
119+
local allowed_origin = get_allowed_origin(origin, allowed_origins)
67120

68-
if contains(allowed_origins, "*") then
69-
core.Debug("CORS: " .. "* allowed")
70-
txn.http:res_add_header("Access-Control-Allow-Origin", "*")
71-
preflight_request(txn, method, allowed_methods)
72-
elseif contains(allowed_origins, origin:match("//([^/]+)")) then
73-
core.Debug("CORS: " .. origin .. " allowed")
74-
txn.http:res_add_header("Access-Control-Allow-Origin", origin)
75-
preflight_request(txn, method, allowed_methods)
76-
else
121+
if allowed_origin == nil then
77122
core.Debug("CORS: " .. origin .. " not allowed")
123+
else
124+
core.Debug("CORS: " .. origin .. " allowed")
125+
txn.http:res_add_header("Access-Control-Allow-Origin", allowed_origin)
78126
end
79127
end
80128

81129
-- Register the actions with HAProxy
82-
core.register_action("cors", {"http-req"}, cors_request, 0)
83-
core.register_action("cors", {"http-res"}, cors_response, 2)
130+
core.register_action("cors", {"http-req"}, cors_request, 2)
131+
core.register_action("cors", {"http-res"}, cors_response, 0)

0 commit comments

Comments
 (0)