37 lines
964 B
Go
37 lines
964 B
Go
package middleware
|
|
|
|
import (
|
|
"RenewCMS/api/pkg/apperr"
|
|
"net/http"
|
|
"net/url"
|
|
)
|
|
|
|
func CrossOriginProtection(publicURL string) func(http.Handler) http.Handler {
|
|
protection := http.NewCrossOriginProtection()
|
|
if origin, ok := originOf(publicURL); ok {
|
|
_ = protection.AddTrustedOrigin(origin)
|
|
}
|
|
protection.SetDenyHandler(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
http.Error(w, apperr.CrossOriginErrorMessage, http.StatusForbidden)
|
|
}))
|
|
|
|
return func(next http.Handler) http.Handler {
|
|
protected := protection.Handler(next)
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.Header.Get("Authorization") != "" {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
protected.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|
|
|
|
func originOf(rawURL string) (string, bool) {
|
|
parsed, err := url.Parse(rawURL)
|
|
if err != nil || parsed.Scheme == "" || parsed.Host == "" {
|
|
return "", false
|
|
}
|
|
return parsed.Scheme + "://" + parsed.Host, true
|
|
}
|