AlinsRan commented on PR #13959: URL: https://github.com/apache/apisix/pull/13959#issuecomment-5726647025
> [P1] Origin validation is disabled by default Fixed in cddc0170f. `Origin` is now checked on every request rather than only where `allowed_origins` was set: - A request with **no** `Origin` is accepted. No non-browser MCP client sends one, and those are most of them. - A request that **carries** one is accepted only from the origin it was addressed to (`scheme://host:port`, compared against the request's own scheme and `Host`). - `allowed_origins` names the other origins a Route accepts. `["*"]` is the explicit escape hatch for a deployment that means to accept any. - An opaque origin — `null`, which a sandboxed frame and a `file://` page send — matches nothing and is refused. Regressions, both transports, all with `allowed_origins` omitted: | | Streamable HTTP | SSE | |---|---|---| | `Origin: https://evil.example.com` | 403, `{"message":"Origin not allowed"}` | 403, same | | `Origin` equal to the request's own origin | served | stream opens | | no `Origin` header | served | stream opens | | `Origin: null` | 403 | — | | `allowed_origins: ["*"]` + evil origin | served | — | One thing I want to be accurate about rather than overclaim: this stops a page on another origin from calling the Route, but it is not by itself a defence against DNS rebinding — there the attacker owns the name, so `Origin` and `Host` are both theirs and match. What does stop that case is a Route that declares `hosts`: a request carrying another `Host` does not match the Route at all. The plugin docs now say exactly this instead of implying the `Origin` check covers rebinding on its own. This is a behaviour change for an existing Route whose clients are browsers on a different origin; they need that origin listed in `allowed_origins`. It is called out in the docs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
