Code

Cors headers#2021

Code

Merged

jefferai merged 135 commits intohashicorp:masterhashicorp/vault:masterfrom naunga:cors-headersnaunga/vault:cors-headersCopy head branch name to clipboardJun 17, 2017

+580-6

Commits

Commits on Oct 10, 2016

• Added function to add CORS headers and handle preflight requests.

  

  Aaron Salvo

  committed
  389434c

Commits on Oct 19, 2016

• Added missing required headers to the Access-Control-Allow-Headers header.

  

  Aaron Salvo

  committed
  cdd2ca8

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  09282a4

• Added config options to enable CORS and set a regexp for origins that are allowed to make cross-origin requests.

  

  Aaron Salvo

  committed
  237a9af

• Reverted to master revision after moving things into more appropriate places.

  

  Aaron Salvo

  committed
  f368d09

• Added wrapper function to apply CORS headers when configured to do so.

  

  Aaron Salvo

  committed
  889ae29

• Added fields to Core and CoreConfig structs to enable CORS if desired. Added supporting code and funcs.

  

  Aaron Salvo

  committed
  8c268e1

Commits on Oct 20, 2016

• Standardized on allowed origins instead of domains.

  

  Aaron Salvo

  committed
  5852bb3

• Added CORS configuration options to the tests and associated files.

  

  Aaron Salvo

  committed
  336ba06

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  1fe3605

• Exported the HandleCORS function and moved the invokation into the server command.

  

  Aaron Salvo

  committed
  88da2da

• This was not the right place to apply the CORS handler. Removed.

  

  Aaron Salvo

  committed
  d18ed18

• Added tests for requests that require CORS.

  

  Aaron Salvo

  committed
  0f5a7fa

• Finalized how and where to apply the CORS headers.

  

  Aaron Salvo

  committed
  fd5494b

• Setting the Origin header in order to test CORS handling.

  

  Aaron Salvo

  committed
  6c54ded

• Removed AllowCORS() func and replaced it with CORSInfo() func. This makes more sense.

  

  Aaron Salvo

  committed
  9b2f66c

• Added configuration for CORS where required.

  

  Aaron Salvo

  committed
  6747af0

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  23490f1

Commits on Nov 8, 2016

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  092b94d

Commits on Nov 9, 2016

• Reverting changes. CORS config to be done via a /sys endpoint.

  

  Aaron Salvo

  committed
  a8cca06

• Reverting changes. CORS config to be done via a /sys endpoint.

  

  Aaron Salvo

  committed
  6d80c03

Commits on Nov 18, 2016

• Refactored to align with the way things are going to be handled.

  

  Aaron Salvo

  committed
  7ca440a

• Refactored to place access to the CORS settings behind the barrier in the system backend, but accessible from the core.

  

  Aaron Salvo

  committed
  71048cf

• Move the logic to add the headers for CORS onto to the cors configuration struct.

  

  Aaron Salvo

  committed
  9a4c9f1

• Merge branch 'cors-headers' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  b5e45ba

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  1171697

Commits on Nov 23, 2016

• Added cors command.

  

  Aaron Salvo

  committed
  71ec898

• Moved to logic determine when to the apply the CORS headers to the ApplyHeaders() func.

  

  Aaron Salvo

  committed
  4584a87

• Made the error returned by CORSConfig() a const.

  

  Aaron Salvo

  committed
  367a04f

• Lots of refactoring and clean up.

  

  Aaron Salvo

  committed
  ca2487f

• Refactoring and DRYing up.

  

  Aaron Salvo

  committed
  4f6b25d

• Added tests for the CORS functionality.

  

  Aaron Salvo

  committed
  3643a10

• Initial commit.

  

  Aaron Salvo

  committed
  a98bba2

• Initial commit.

  

  Aaron Salvo

  committed
  e57ac5e

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  5cbc9fe

Commits on Nov 24, 2016

• Added help text.

  

  Aaron Salvo

  committed
  ceb493e

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  9957df9

Commits on Nov 28, 2016

• Fixed a bunch of logic bugs that were causing the server to panic after checking the status of the CORS configuration.

  

  Aaron Salvo

  committed
  7aa839c

Commits on Nov 29, 2016

• Removed debug code.

  

  Aaron Salvo

  committed
  a974a2b

• Fixed logic bug.

  

  Aaron Salvo

  committed
  ef2a522

• Added code to ensure the server responds correctly when the CORS request fails.

  

  Aaron Salvo

  committed
  b22172e

• Skip handling the logical request for preflights.

  

  Aaron Salvo

  committed
  dd06686

• Flesh out tests for CORS handler

  

  Aaron Salvo

  committed
  0ad8ac3

• Refactored so that the core is created with an empty CORSConfig vs. having that field set to nil. Much cleaner this way and doesn't require returning an error from the CORSConfig() func.

  

  Aaron Salvo

  committed
  796f0ef

• Refactored ApplyHeaders() to return a 403 if the origin is not valid and a 405 if the requested method is not allowed. validOrigin will now properly handle nil origins.

  

  Aaron Salvo

  committed
  f1a9225

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  338fdb1

• Fixed typo in comments.

  

  Aaron Salvo

  committed
  ec20fbc

Commits on Nov 30, 2016

• Removed (presently) unnecessary test.

  

  Aaron Salvo

  committed
  582189d

• Added documentation for CORS functionality.

  

  Aaron Salvo

  committed
  121e0ed

Commits on Dec 2, 2016

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  a247952

• Added a new custom header that tells the Vault server to bypass the CORS handler for requests from the Vault client.

  

  Aaron Salvo

  committed
  50a0c11

• CORS handler now applies to all paths. Added logic to bypass the CORS handler if the request is coming from the Vault client.

  

  Aaron Salvo

  committed
  e5ff73f

• Disable() func now sets the core's CORS config to disabled and clears the allow origins instead of setting the entire config to nil.

  

  Aaron Salvo

  committed
  799cc8c

• handleCORSDisable was setting the core's corsConfig property to nil instead of calling CORSConfig.Disable(). This was bad.

  

  Aaron Salvo

  committed
  673365a

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  02edf8e

• Fixed failing tests.

  

  Aaron Salvo

  committed
  7122b8c

Commits on Dec 4, 2016

• Fixed a typo in a comment.

  

  Aaron Salvo

  committed
  7eeba1e

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  d3a5e45

• Vary header will now be returned.

  

  Aaron Salvo

  committed
  5c05c80

Commits on Dec 7, 2016

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  d809e4e

• Refactored code and updated documents to reflect that the allowed origins is now configured by setting it to a wildcard or a space-separated list of origins, instead of a regular expression.

  

  Aaron Salvo

  committed
  3bba275

Commits on Dec 14, 2016

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  fd735ba

Commits on Dec 16, 2016

• Merged master and resolved conflicts.

  

  Aaron Salvo

  committed
  7b22c2a

Commits on Dec 18, 2016

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  3dba363

Commits on Dec 19, 2016

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  ff022b6

Commits on Dec 20, 2016

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  edab784

Commits on Jan 10, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  919e916

Commits on Jan 16, 2017

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  1e40dc8

Commits on Jan 18, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  0031687

Commits on Jan 20, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  18bb96b

Commits on Jan 24, 2017

• Removed unnecessary header.

  

  Aaron Salvo

  committed
  13bf4ae

• Remove cors CLI command.

  

  Aaron Salvo

  committed
  543cebd

• Merged the handleCORS() func into wrapCORSHandler(). Was not necessary to have two functions.

  

  Aaron Salvo

  committed
  027e546

• Removed unnecessary header.

  

  Aaron Salvo

  committed
  d838b8e

• Move check for preflight requests up to the CORS handler where it belonged.

  

  Aaron Salvo

  committed
  9d5fb2a

• Removed unneeded struct fields. Changed pointers to slices to just slices. No longer using a regular expression to check that the wildcard is the sole origin when used.

  

  Aaron Salvo

  committed
  75955d5

• Refactored help text and code to reflect the fact that CORSConfig.allowedOrigins is no longer a regular expression.

  

  Aaron Salvo

  committed
  e27b992

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  1dbb7e1

Commits on Jan 25, 2017

• New config store for api-managable configurations.

  

  Aaron Salvo

  committed
  8c0a7c9

Commits on Jan 26, 2017

• Added Settings field to Config struct to allow for many types of configurations to be stored. setupConfigStore will now allow for loading existing configs at unseal time.

  

  Aaron Salvo

  committed
  8ed7fe8

• Refactored to use new Config structure.

  

  Aaron Salvo

  committed
  580ca52

• Added configStore to Core. Wired up unseal and seal tasks.

  

  Aaron Salvo

  committed
  0ab733d

• Simplified things a bit.

  

  Aaron Salvo

  committed
  7645af4

• Added code to update the ConfigStore.

  

  Aaron Salvo

  committed
  1b48377

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  cb2ccd7

• Fixed a typo that was making the test fail.

  

  Aaron Salvo

  committed
  5f16cf7

• Added missing response headers. Renamed allowedHeaders to responseHeaders to avoid confusion with the 'Access-Control-Allow-Headers' header. Added 'Vary' header to the responseHeaders slice instead…

  Show description for 70b9a9b
  

  Aaron Salvo

  committed
  70b9a9b

• Refactored newCORSConfig() out.

  

  Aaron Salvo

  committed
  f70c6dc

Commits on Jan 27, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  47f52cb

Commits on Jan 30, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  b7be8c5

Commits on Jan 31, 2017

• Moved logic of when to apply the CORS headers here. This makes the logic easier to follow.

  

  Aaron Salvo

  committed
  0859a85

• Refactored CORS handler test to reflect the current state of things.

  

  Aaron Salvo

  committed
  0968686

• It is not necessary to set the isEnabled flag on the CORSConfig. This is done by the CORSConfig.Enable() func.

  

  Aaron Salvo

  committed
  26af710

• Creating an instance of a sync.RWMutex for the CORSConfig when the core is created.

  

  Aaron Salvo

  committed
  4ac6a0b

• Renamed responseHeaders to preflightHeaders. Added 'LIST' method to list of allowed methods. Refactored the export fields in CORSConfig struct to be unexported and added a RWMutex to the struct. Ad…

  Show description for e1afa97
  

  Aaron Salvo

  committed
  e1afa97

• Renamed handleCORSEnable, Disable, and Status to handleCORSUpdate, Delete, and Read. Also no longer returning values from the handleCORSUpdate and handleCORSDelete funcs. They will simply return a …

  Show description for 4b5a32a
  

  Aaron Salvo

  committed
  4b5a32a

• Changed docs to reflect the fact that the CORS Update and Delete funcs simply return a 204.

  

  Aaron Salvo

  committed
  3127933

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  2bfa2e7

• Refactor test to reflect the fact that the CORS Update and Delete methods return no data.

  

  Aaron Salvo

  committed
  c3447f4

Commits on Feb 1, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  014ab2e

Commits on Feb 5, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  10a5976

• Merged handleCORSRead() and corsStatusResponse() into a single func.

  

  Aaron Salvo

  committed
  54ce27b

Commits on Feb 7, 2017

• Moved logic to determine when to apply the CORS headers to the http handler. This was a more logical place to put it.

  

  Aaron Salvo

  committed
  6bc49a5

• Removed the config store.

  

  Aaron Salvo

  committed
  bb5d81d

• Gave the test a URL that is actually valid.

  

  Aaron Salvo

  committed
  9afc279

• Refactored after removing the ConfigStore.

  

  Aaron Salvo

  committed
  3b0a32d

• Exported the Enabled and AllowedOrigins fields of the CORSConfig struct for JSON encoding.

  Show description for d8a689a
  

  Aaron Salvo

  committed
  d8a689a

• Updated field names.

  

  Aaron Salvo

  committed
  077dfad

Commits on Feb 8, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  7f67976

Commits on Feb 20, 2017

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  3d94364

Commits on Feb 28, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  46d451b

Commits on Mar 1, 2017

• Moved the code to put the headers on the response here. Instead of making it part of the CORSConfig struct.

  

  Aaron Salvo

  committed
  fca8f36

• CORSConfig.Get() was removed. Updated to reflect that. Fixed a typo in vault/core.go.

  

  Aaron Salvo

  committed
  468fda3

• Removed ApplyHeaders and Get(). Applied correct locks where needed. Fixed typos, and put the embedded Mutex struct as the first field in the CORSConfig struct for the sake of readability.

  

  Aaron Salvo

  committed
  2a5a5ef

Commits on Mar 3, 2017

• Was missing a return after writing the headers for a preflight request, which was resulting in an erroneous 405.

  

  Aaron Salvo

  committed
  f6f18b8

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  1adc2d7

Commits on Mar 8, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  e7f4662

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  48dd63f

Commits on Mar 9, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  d26b641

Commits on Mar 14, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  e55caae

Commits on Mar 20, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  7da6630

Commits on Apr 10, 2017

• Merge branch 'master' into cors-headers

  

  Aaron Salvo

  committed
  54314e0

Commits on May 6, 2017

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  ec019db

Commits on May 10, 2017

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  117326a

• Updated imports.

  

  Aaron Salvo

  committed
  607d2d5

• Made parameter to Enable a string slice.

  

  Aaron Salvo

  committed
  ed209aa

• Fixed a typo.

  

  Aaron Salvo

  committed
  bd48453

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  1bcdf0f

• Corrected parameter to func Enable.

  

  Aaron Salvo

  committed
  b5e9b84

• Added Access-Control-Max-Age header to list of expected headers.

  

  Aaron Salvo

  committed
  4fbeadb

• Enable func returns an error if the list of URLs is empty. Reworded error message when trying to use the wildcard and URLs.

  

  Aaron Salvo

  committed
  8c9b4e2

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  79a87ea

Commits on Jun 15, 2017

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  370585b

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  3403c2d

Commits on Jun 16, 2017

• Merge branch 'master' of github.com:naunga/vault into cors-headers

  

  Aaron Salvo

  committed
  b7be115