Override to enable support for allowing alternate origins. The ``origin`` argument is the value of the ``Origin`` HTTP header, the url responsible for initiating this request. This method is not called for clients that do not send this header; such requests are alwa
(self, origin: str)
| 486 | self.ws_connection = None |
| 487 | |
| 488 | def check_origin(self, origin: str) -> bool: |
| 489 | """Override to enable support for allowing alternate origins. |
| 490 | |
| 491 | The ``origin`` argument is the value of the ``Origin`` HTTP |
| 492 | header, the url responsible for initiating this request. This |
| 493 | method is not called for clients that do not send this header; |
| 494 | such requests are always allowed (because all browsers that |
| 495 | implement WebSockets support this header, and non-browser |
| 496 | clients do not have the same cross-site security concerns). |
| 497 | |
| 498 | Should return ``True`` to accept the request or ``False`` to |
| 499 | reject it. By default, rejects all requests with an origin on |
| 500 | a host other than this one. |
| 501 | |
| 502 | This is a security protection against cross site scripting attacks on |
| 503 | browsers, since WebSockets are allowed to bypass the usual same-origin |
| 504 | policies and don't use CORS headers. |
| 505 | |
| 506 | .. warning:: |
| 507 | |
| 508 | This is an important security measure; don't disable it |
| 509 | without understanding the security implications. In |
| 510 | particular, if your authentication is cookie-based, you |
| 511 | must either restrict the origins allowed by |
| 512 | ``check_origin()`` or implement your own XSRF-like |
| 513 | protection for websocket connections. See `these |
| 514 | <https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html>`_ |
| 515 | `articles |
| 516 | <https://devcenter.heroku.com/articles/websocket-security>`_ |
| 517 | for more. |
| 518 | |
| 519 | To accept all cross-origin traffic (which was the default prior to |
| 520 | Tornado 4.0), simply override this method to always return ``True``:: |
| 521 | |
| 522 | def check_origin(self, origin): |
| 523 | return True |
| 524 | |
| 525 | To allow connections from any subdomain of your site, you might |
| 526 | do something like:: |
| 527 | |
| 528 | def check_origin(self, origin): |
| 529 | parsed_origin = urllib.parse.urlparse(origin) |
| 530 | return parsed_origin.netloc.endswith(".mydomain.com") |
| 531 | |
| 532 | .. versionadded:: 4.0 |
| 533 | |
| 534 | """ |
| 535 | parsed_origin = urlparse(origin) |
| 536 | origin = parsed_origin.netloc |
| 537 | origin = origin.lower() |
| 538 | |
| 539 | host = self.request.headers.get("Host") |
| 540 | |
| 541 | # Check to see that origin matches host directly, including ports |
| 542 | return origin == host |
| 543 | |
| 544 | def set_nodelay(self, value: bool) -> None: |
| 545 | """Set the no-delay flag for this stream. |