Skip to content

Commit 88d2d5f

Browse files
committed
Honor existing Origin header when using WebSockets, otherwise use secured scheme for wss, close AsyncHttpClient#1448
Motivation: When performing initial WebSocket HTTP request, we force Origin header. This is wrong, as Origin might use a different domain than WebSocket url. Also, when computing default Origin, it would make sense to use a secure scheme when using secured sockets. Modifications: * Don’t override existing Origin header * Use https for wss Result: It’s now possible to set Origin on a different domain. Better default
1 parent 3cc4a95 commit 88d2d5f

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -194,10 +194,15 @@ public NettyRequest newNettyRequest(Request request, boolean forceConnect, Proxy
194194
if (!connect && uri.isWebSocket()) {
195195
headers.set(UPGRADE, HttpHeaderValues.WEBSOCKET)//
196196
.set(CONNECTION, HttpHeaderValues.UPGRADE)//
197-
.set(ORIGIN, "http://" + uri.getHost() + ":" + uri.getExplicitPort())//
198197
.set(SEC_WEBSOCKET_KEY, getKey())//
199198
.set(SEC_WEBSOCKET_VERSION, "13");
200199

200+
if (!headers.contains(ORIGIN)) {
201+
String scheme = uri.isSecured() ? "https://" : "http://";
202+
String origin = scheme+ uri.getHost() + ":" + uri.getExplicitPort();
203+
headers.set(ORIGIN, origin);
204+
}
205+
201206
} else if (!headers.contains(CONNECTION)) {
202207
CharSequence connectionHeaderValue = connectionHeader(config.isKeepAlive(), httpVersion);
203208
if (connectionHeaderValue != null) {

0 commit comments

Comments
 (0)