Skip to content

Commit 4e49e69

Browse files
committed
Honor existing Origin header when using WebSockets, otherwise use sec… …ured scheme for wss, close AsyncHttpClient#1448
Motivation: When performing initial WebSocket HTTP request, we force Origin header. This is wrong, as Origin might use a different domain than WebSocket url. Also, when computing default Origin, it would make sense to use a secure scheme when using secured sockets. Modifications: * Don’t override existing Origin header * Use https for wss Result: It’s now possible to set Origin on a different domain. Better default
1 parent 2b68960 commit 4e49e69

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,10 +196,15 @@ public NettyRequest newNettyRequest(Request request, boolean forceConnect, Proxy
196196
if (!connect && uri.isWebSocket()) {
197197
headers.set(HttpHeaders.Names.UPGRADE, HttpHeaders.Values.WEBSOCKET)//
198198
.set(CONNECTION, HttpHeaders.Values.UPGRADE)//
199-
.set(ORIGIN, "http://" + uri.getHost() + ":" + uri.getExplicitPort())//
200199
.set(SEC_WEBSOCKET_KEY, getKey())//
201200
.set(SEC_WEBSOCKET_VERSION, "13");
202201

202+
if (!headers.contains(ORIGIN)) {
203+
String scheme = uri.isSecured() ? "https://" : "http://";
204+
String origin = scheme + uri.getHost() + ":" + uri.getExplicitPort();
205+
headers.set(ORIGIN, origin);
206+
}
207+
203208
} else if (!headers.contains(CONNECTION)) {
204209
String connectionHeaderValue = connectionHeader(config.isKeepAlive(), httpVersion);
205210
if (connectionHeaderValue != null)

0 commit comments

Comments
 (0)