diff --git a/IPython/html/base/zmqhandlers.py b/IPython/html/base/zmqhandlers.py index 4cd98e2..f9f1eb1 100644 --- a/IPython/html/base/zmqhandlers.py +++ b/IPython/html/base/zmqhandlers.py @@ -42,7 +42,11 @@ class ZMQStreamHandler(websocket.WebSocketHandler): host = self.request.headers.get("Host") # If no header is provided, assume we can't verify origin - if(origin is None or host is None): + if origin is None: + self.log.warn("Missing Origin header, rejecting WebSocket connection.") + return False + if host is None: + self.log.warn("Missing Host header, rejecting WebSocket connection.") return False origin = origin.lower() @@ -54,13 +58,17 @@ class ZMQStreamHandler(websocket.WebSocketHandler): # Check CORS headers if self.allow_origin: - return self.allow_origin == origin + allow = self.allow_origin == origin elif self.allow_origin_pat: - return bool(self.allow_origin_pat.match(origin)) + allow = bool(self.allow_origin_pat.match(origin)) else: # No CORS headers deny the request - self.log.warn("Cross Origin WebSocket Attempt from %s", self.get_origin()) - return False + allow = False + if not allow: + self.log.warn("Blocking Cross Origin WebSocket Attempt. Origin: %s, Host: %s", + origin, host, + ) + return allow def clear_cookie(self, *args, **kwargs): """meaningless for websockets"""