actix/actix-extras
1
0
Fork 0
mirror of https://github.com/actix/actix-extras.git synced 2025-06-26 10:27:42 +02:00
Code Issues Releases Wiki Activity

fix!(cors): default block_on_origin_mismatch to false (#379)

Browse Source
This commit is contained in:
Rob Ede
2024-01-06 20:40:44 +00:00
committed by GitHub
parent e2bf504055
commit d55fc6d7f5
4 changed files with 35 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
actix-cors/src/builder.rs
View File

@ -115,7 +115,7 @@ impl Cors {
#[cfg(feature = "draft-private-network-access")]
allow_private_network_access: false,
vary_header: true,
block_on_origin_mismatch: true,
block_on_origin_mismatch: false,
};
Cors {
@ -477,7 +477,7 @@ impl Cors {
/// and block requests based on pre-flight requests. Use this setting to allow cURL and other
/// non-browser HTTP clients to function as normal, no matter what `Origin` the request has.
///
/// Defaults to true.
/// Defaults to false.
pub fn block_on_origin_mismatch(mut self, block: bool) -> Cors {
if let Some(cors) = cors(&mut self.inner, &self.error) {
cors.block_on_origin_mismatch = block;
@ -513,7 +513,7 @@ impl Default for Cors {
#[cfg(feature = "draft-private-network-access")]
allow_private_network_access: false,
vary_header: true,
block_on_origin_mismatch: true,
block_on_origin_mismatch: false,
};
Cors {
@ -646,8 +646,9 @@ mod test {
.insert_header(("Origin", "https://www.example.com"))
.to_srv_request();
let resp = test::call_service(&cors, req).await;
assert_eq!(resp.status(), StatusCode::BAD_REQUEST);
let res = test::call_service(&cors, req).await;
assert_eq!(res.status(), StatusCode::OK);
assert!(!res.headers().contains_key("Access-Control-Allow-Origin"));
}
#[actix_web::test]

1
actix-cors/src/inner.rs
View File

@ -266,6 +266,7 @@ mod test {
async fn test_validate_not_allowed_origin() {
let cors = Cors::default()
.allowed_origin("https://www.example.com")
.block_on_origin_mismatch(true)
.new_transform(test::ok_service())
.await
.unwrap();