Use Tornado default WebSocket check_origin function

CHANGES.md

@@ -5,6 +5,32 @@ all changes see the [closed
 milestones](https://github.com/cylc/cylc-uiserver/milestones?state=closed) for
 each release.
 
+-------------------------------------------------------------------------------
+## __cylc-uiserver-0.3 (2020-??-??)__
+
+Release 0.3 of Cylc UI Server.
+
+### Backward incompatible changes
+
+None or N/A.
+
+### Enhancements
+
+[#125](https://github.com/cylc/cylc-uiserver/pull/125) - Use Tornado
+default WebSocket check_origin function.
+
+### Fixes
+
+None.
+
+### Documentation
+
+None.
+
+### Security issues
+
+None.
+
 -------------------------------------------------------------------------------
 ## __cylc-uiserver-0.2 (2020-07-14)__
 

cylc/uiserver/handlers.py

@@ -157,9 +157,6 @@ async def recv(self):
     def recv_nowait(self):
         return self.queue.get_nowait()
 
-    def check_origin(self, origin: str) -> bool:
-        return True
-
     @property
     def context(self):
         wider_context = {

cylc/uiserver/tests/test_handlers.py

@@ -110,9 +110,31 @@ def test_websockets_subprotocol(self):
         handler = self._create_handler()
         assert handler.select_subprotocol(subprotocols=[]) == GRAPHQL_WS
 
-    def test_websockets_check_origin(self):
+    def test_websockets_check_origin_accepts_same_origin(self):
+        """A request that includes the Host header must use the same
+        value as the server host, or an error is raised.
+
+        This prevents CORS attacks. In Cylc UI, it should work as we
+        expect the Host header to be set by the browser when you navigate
+        to the UI Server. Once your browser opens the WebSocket request
+        it should match the Host of the UI Server.
+        """
         handler = self._create_handler()
-        assert handler.check_origin(origin='')
+        host_header = 'ui.cylc'
+        handler.request.headers['Host'] = host_header
+        assert handler.check_origin(origin=f'http://{host_header}')
+
+    def test_websockets_check_origin_rejects_different_origin(self):
+        """A request from a different Host MUST be blocked to prevent
+        CORS attacks.
+
+        This is the default after Tornado 4, and helps secure Cylc UI
+        WebSocket endpoint. Change this behavior carefully.
+        """
+        handler = self._create_handler()
+        host_header = 'ui.cylc'
+        handler.request.headers['Host'] = host_header
+        assert not handler.check_origin(origin=f'http://ui.notcylc')
 
     def test_websockets_context(self):
         handler = self._create_handler()