fix: match Origin scheme if defined in OriginPatterns (#536)

mafredri · web-flow · commit e11dd4e74117 · 2025-09-03T11:05:14.000+03:00
This change aligns origin checks with RFC 6454 by adding scheme-aware matching to OriginPatterns. Fixes #529
diff --git a/accept.go b/accept.go
@@ -40,9 +40,10 @@ type AcceptOptions struct {
 	// In such a case, example.com is the origin and chat.example.com is the request host.
 	// One would set this field to []string{"example.com"} to authorize example.com to connect.
 	//
-	// Each pattern is matched case insensitively against the request origin host
-	// with path.Match.
-	// See https://golang.org/pkg/path/#Match
+	// Each pattern is matched case insensitively with path.Match (see
+	// https://golang.org/pkg/path/#Match). By default, it is matched
+	// against the request origin host. If the pattern contains a URI
+	// scheme ("://"), it will be matched against "scheme://host".
 	//
 	// Please ensure you understand the ramifications of enabling this.
 	// If used incorrectly your WebSocket server will be open to CSRF attacks.
@@ -240,7 +241,11 @@ func authenticateOrigin(r *http.Request, originHosts []string) error {
 	}
 
 	for _, hostPattern := range originHosts {
-		matched, err := match(hostPattern, u.Host)
+		target := u.Host
+		if strings.Contains(hostPattern, "://") {
+			target = u.Scheme + "://" + u.Host
+		}
+		matched, err := match(hostPattern, target)
 		if err != nil {
 			return fmt.Errorf("failed to parse path pattern %q: %w", hostPattern, err)
 		}
diff --git a/accept_test.go b/accept_test.go
@@ -466,6 +466,42 @@ func Test_authenticateOrigin(t *testing.T) {
 			},
 			success: false,
 		},
+		{
+			name:   "originPatternsWithSchemeHttps",
+			origin: "https://two.example.com",
+			host:   "example.com",
+			originPatterns: []string{
+				"https://*.example.com",
+			},
+			success: true,
+		},
+		{
+			name:   "originPatternsWithSchemeMismatch",
+			origin: "https://two.example.com",
+			host:   "example.com",
+			originPatterns: []string{
+				"http://*.example.com",
+			},
+			success: false,
+		},
+		{
+			name:   "originPatternsWithSchemeAndPort",
+			origin: "https://example.com:8443",
+			host:   "example.com",
+			originPatterns: []string{
+				"https://example.com:8443",
+			},
+			success: true,
+		},
+		{
+			name:   "backwardsCompatHostOnlyPattern",
+			origin: "http://two.example.com",
+			host:   "example.com",
+			originPatterns: []string{
+				"*.example.com",
+			},
+			success: true,
+		},
 	}
 
 	for _, tc := range testCases {
