##// END OF EJS Templates
Name change to same_origin
Kyle Kelley -
Show More
@@ -43,19 +43,20 b' from .handlers import IPythonHandler'
43
43
44 class ZMQStreamHandler(websocket.WebSocketHandler):
44 class ZMQStreamHandler(websocket.WebSocketHandler):
45
45
46 def is_cross_origin(self):
46 def same_origin(self):
47 """Check to see that origin and host match in the headers."""
47 """Check to see that origin and host match in the headers."""
48 origin_header = self.request.headers.get("Origin")
48 origin_header = self.request.headers.get("Origin")
49 host = self.request.headers.get("Host")
49 host = self.request.headers.get("Host")
50
50
51 # If no header is provided, assume we can't verify origin
51 if(origin_header == None or host == None):
52 if(origin_header == None or host == None):
52 return True
53 return False
53
54
54 parsed_origin = urlparse(origin_header)
55 parsed_origin = urlparse(origin_header)
55 origin = parsed_origin.netloc
56 origin = parsed_origin.netloc
56
57
57 # Check to see that origin matches host directly, including ports
58 # Check to see that origin matches host directly, including ports
58 return origin != host
59 return origin == host
59
60
60 def clear_cookie(self, *args, **kwargs):
61 def clear_cookie(self, *args, **kwargs):
61 """meaningless for websockets"""
62 """meaningless for websockets"""
@@ -106,7 +107,7 b' class AuthenticatedZMQStreamHandler(ZMQStreamHandler, IPythonHandler):'
106
107
107 def open(self, kernel_id):
108 def open(self, kernel_id):
108 # Check to see that origin matches host directly, including ports
109 # Check to see that origin matches host directly, including ports
109 if self.is_cross_origin():
110 if not self.same_origin():
110 self.log.warn("Cross Origin WebSocket Attempt.")
111 self.log.warn("Cross Origin WebSocket Attempt.")
111 raise web.HTTPError(404)
112 raise web.HTTPError(404)
112
113
General Comments 0
You need to be logged in to leave comments. Login now