nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-07-02 00:22:50 -05:00
Code Activity

adjust cors origin checks (#800)

Browse Source 
* allow cors from bitwarden.com on cloud

* allow file:// cors for safari extension

* fix missing paren
This commit is contained in:
Kyle Spearrin
2020-06-27 15:08:50 -04:00
committed by GitHub
parent 448157b07c
commit 6bc7a3cdc0
6 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/Core/IdentityServer/VaultCorsPolicyService.cs
View File

@ -1,20 +1,21 @@
using IdentityServer4.Services;
using Bit.Core.Utilities;
using IdentityServer4.Services;
using System.Threading.Tasks;
namespace Bit.Core.IdentityServer
{
public class VaultCorsPolicyService : ICorsPolicyService
public class CustomCorsPolicyService : ICorsPolicyService
{
private readonly GlobalSettings _globalSettings;
public VaultCorsPolicyService(GlobalSettings globalSettings)
public CustomCorsPolicyService(GlobalSettings globalSettings)
{
_globalSettings = globalSettings;
}
public Task<bool> IsOriginAllowedAsync(string origin)
{
return Task.FromResult(origin == _globalSettings.BaseServiceUri.Vault);
return Task.FromResult(CoreHelpers.IsCorsOriginAllowed(origin, _globalSettings));
}
}
}

11
src/Core/Utilities/CoreHelpers.cs
View File

@ -595,5 +595,16 @@ namespace Bit.Core.Utilities
return httpContext.Connection?.RemoteIpAddress?.ToString();
}
public static bool IsCorsOriginAllowed(string origin, GlobalSettings globalSettings)
{
return
// Web vault
origin == globalSettings.BaseServiceUri.Vault ||
// Safari extension origin
origin == "file://" ||
// Product website
(!globalSettings.SelfHosted && origin == "https://bitwarden.com");
}
}
}

2
src/Core/Utilities/ServiceCollectionExtensions.cs
View File

@ -382,7 +382,7 @@ namespace Bit.Core.Utilities
}
services.AddTransient<ClientStore>();
services.AddTransient<ICorsPolicyService, VaultCorsPolicyService>();
services.AddTransient<ICorsPolicyService, CustomCorsPolicyService>();
services.AddScoped<IResourceOwnerPasswordValidator, ResourceOwnerPasswordValidator>();
services.AddScoped<IProfileService, ProfileService>();
services.AddSingleton<IPersistedGrantStore, PersistedGrantStore>();