Commit b2331a9
committed
[release-v2.1] rpcserver: Fix CheckOrigin inverted err check.
When both the `Origin` header and the request `Host` header lack an
explicit port (common behind reverse proxies on standard ports 443/80),
both values collapse to empty string, and `equalASCIIFold("",
"")` returns `true` - allowing **any cross-origin websocket handshake**
to succeed.1 parent 7711005 commit b2331a9
1 file changed
Lines changed: 2 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
5964 | 5964 | | |
5965 | 5965 | | |
5966 | 5966 | | |
5967 | | - | |
| 5967 | + | |
5968 | 5968 | | |
5969 | 5969 | | |
5970 | | - | |
| 5970 | + | |
5971 | 5971 | | |
5972 | 5972 | | |
5973 | 5973 | | |
| |||
0 commit comments