Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cors: Don't overwrite vary header set by the inner service #398

Merged
merged 3 commits into from
Jan 13, 2024
Merged

cors: Don't overwrite vary header set by the inner service #398

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c969dbe
cors: Send a single vary header with comma-separated values
jplatte Aug 17, 2023
6769837
cors: Don't overwrite vary header set by the inner service
jplatte Oct 1, 2023
ed035ea
Update CHANGELOG.md
jplatte Jan 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 8 additions & 15 deletions tower-http/src/cors/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -618,24 +618,10 @@ where

// These headers are applied to both preflight and subsequent regular CORS requests:
// https://fetch.spec.whatwg.org/#http-responses

headers.extend(self.layer.allow_origin.to_header(origin, &parts));
headers.extend(self.layer.allow_credentials.to_header(origin, &parts));
headers.extend(self.layer.allow_private_network.to_header(origin, &parts));

let mut vary_headers = self.layer.vary.values();
if let Some(first) = vary_headers.next() {
let mut header = match headers.entry(header::VARY) {
header::Entry::Occupied(_) => {
unreachable!("no vary header inserted up to this point")
}
header::Entry::Vacant(v) => v.insert_entry(first),
};

for val in vary_headers {
header.append(val);
}
}
headers.extend(self.layer.vary.to_header());

// Return results immediately upon preflight request
if parts.method == Method::OPTIONS {
Expand Down Expand Up @@ -695,6 +681,13 @@ where
match self.project().inner.project() {
KindProj::CorsCall { future, headers } => {
let mut response: Response<B> = ready!(future.poll(cx))?;

// vary header can have multiple values, don't overwrite
// previously-set value(s).
if let Some(vary) = headers.remove(header::VARY) {
headers.append(header::VARY, vary);
}
// extend will overwrite previous headers of remaining names
response.headers_mut().extend(headers.drain());

Poll::Ready(Ok(response))
Expand Down
33 changes: 33 additions & 0 deletions tower-http/src/cors/tests.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
use std::convert::Infallible;

use http::{header, HeaderValue, Request, Response};
use hyper::Body;
use tower::{service_fn, util::ServiceExt, Layer};

use crate::cors::CorsLayer;

#[tokio::test]
#[allow(
clippy::declare_interior_mutable_const,
clippy::borrow_interior_mutable_const
)]
async fn vary_set_by_inner_service() {
const CUSTOM_VARY_HEADERS: HeaderValue = HeaderValue::from_static("accept, accept-encoding");
const PERMISSIVE_CORS_VARY_HEADERS: HeaderValue = HeaderValue::from_static(
"origin, access-control-request-method, access-control-request-headers",
);

async fn inner_svc(_: Request<Body>) -> Result<Response<Body>, Infallible> {
Ok(Response::builder()
.header(header::VARY, CUSTOM_VARY_HEADERS)
.body(Body::empty())
.unwrap())
}

let svc = CorsLayer::permissive().layer(service_fn(inner_svc));
let res = svc.oneshot(Request::new(Body::empty())).await.unwrap();
let mut vary_headers = res.headers().get_all(header::VARY).into_iter();
assert_eq!(vary_headers.next(), Some(&CUSTOM_VARY_HEADERS));
assert_eq!(vary_headers.next(), Some(&PERMISSIVE_CORS_VARY_HEADERS));
assert_eq!(vary_headers.next(), None);
}
15 changes: 12 additions & 3 deletions tower-http/src/cors/vary.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
use std::array;

use http::{header::HeaderName, HeaderValue};
use http::header::{self, HeaderName, HeaderValue};

use super::preflight_request_headers;

Expand All @@ -26,8 +26,17 @@ impl Vary {
Self(headers.into_iter().map(Into::into).collect())
}

pub(super) fn values(&self) -> impl Iterator<Item = HeaderValue> + '_ {
self.0.iter().cloned()
pub(super) fn to_header(&self) -> Option<(HeaderName, HeaderValue)> {
let values = &self.0;
let mut res = values.get(0)?.as_bytes().to_owned();
for val in &values[1..] {
res.extend_from_slice(b", ");
res.extend_from_slice(val.as_bytes());
}

let header_val = HeaderValue::from_bytes(&res)
.expect("comma-separated list of HeaderValues is always a valid HeaderValue");
Some((header::VARY, header_val))
}
}

Expand Down
Loading