Method checkLoginCORS

rest/session_api.go:360–369

checkLoginCORS validates the auth.CORSConfig.LoginOrigin section of CORS for requests. Note: Validation of the general Origin header against auth.CORSConfig.Origin happens separately in validateAndWriteHeaders.

()

// checkLoginCORS validates the auth.CORSConfig.LoginOrigin section of CORS for requests.
// Note: Validation of the general Origin header against auth.CORSConfig.Origin happens separately in validateAndWriteHeaders.
func (h *handler) checkLoginCORS() error {
	originHeader := h.rq.Header["Origin"]
	if len(originHeader) > 0 {
		cors := h.getCORSConfig()
		if cors.IsEmpty() || auth.MatchedOrigin(cors.LoginOrigin, originHeader) == "" {
			return base.HTTPErrorf(http.StatusBadRequest, "No CORS")
		}
	}
	return nil
}