Set explicit Origin in CORS preflight response if allow_credentials is True and allow_origins is wildcard #1113

jcwilson · 2020-12-11T10:23:56Z

When a non-simple request will include credentials, the browser will likely send a CORS preflight request.
The browser will fail the request unless the preflight response explicitly allows the request's Origin in the
Access-Control-Allow-Origin response header rather than *.

This can be resolved by updating the CORS middleware to respond to preflight requests with the explicit
origin from the request rather than the literal * wildcard value when allow_credentials=True.

The current workaround is to provide an equivalently permissive allow_origin_regex pattern like ".*",
but this would appear to be a POLA violation. If one wishes to allow calls from all origins, regardless of the
allow_credentials setting, then allow_origins=["*"] should be sufficient to express that intent.

The simple_response() code already performs similar logic which currently only applies to non-preflight
requests:

# If request includes any cookie headers, then we must respond
# with the specific origin instead of '*'.
if self.allow_all_origins and has_cookie:
    headers["Access-Control-Allow-Origin"] = origin

This PR just updates the preflight logic to match the simple request logic. The difference is that preflight
requests won't contain cookies so we can't perform the same has_cookie check. That's why we'll rely
on the allow_credentials setting.

See the relevant MDN CORS docs here:

When used as part of a response to a preflight request, this indicates whether or not the actual request can
be made using credentials. Note that simple GET requests are not preflighted, and so if a request is made for
a resource with credentials, if this header is not returned with the resource, the response is ignored by the
browser and not returned to web content.

Note: This could be considered an interface-breaking change and demand a stronger version bump if starlette
follows a strict semver policy. Servers that currently specify allow_origins="*" instruct the browser to
block credentialed CORS calls that require preflight authorization. Adopting this behavior would allow these
calls through and could result in an unexpected relaxation of their current effective security rules. However, it
looks like starlette is still pre-1.0.0, so maybe this just means a minor version bump?

…s True and allow_origins is wildcard When making a preflight request, the browser makes no indication as to whether the actual subsequent request will pass up credentials. However, unless the preflight response explicitly allows the request's `Origin` in the `Access-Control-Response-Header`, the browser will fail the CORS check and prevent the actual follow-up CORS request. This means that responding with the `*` wildcard is not sufficient to allow preflighted credentialed requests. The current workaround is to provide an equivalently permissive `allow_origin_regex` pattern. The `simple_response()` code already performs similar logic which currently only applies to non-preflighted requests since the browser would never make a preflighted request that hits this code due to this issue: ``` if self.allow_all_origins and has_cookie: headers["Access-Control-Allow-Origin"] = origin ``` This just bring the two halves inline with each other.

jcwilson · 2021-04-07T00:19:52Z

This is the error one currently gets when attempting to make a CORS request with credentials and allow_origins=["*"]

jcwilson · 2021-04-07T00:23:53Z

@JayH5 thanks for taking care of the other CORS PRs. Let me know if there's anything I can do to help out with this one. I know CORS is such a headache to context switch to.

This simplifies the code slightly by using this recently added method. It has some trade-offs, though. We now construct a `MutableHeaders` instead of a simple `dict` when copying the pre-computed preflight headers, and we move the `Vary` header construction out of the pre-computation and into the call handler. I think it makes the code more maintainable and the added per-call computation is minimal.

starlette/middleware/cors.py

This also names and caches some of the boolean tests in __init__() which we use in later if-blocks. This follows the existing pattern in order to better self-document the code.

jcwilson · 2021-04-07T06:32:54Z

starlette/middleware/cors.py

        preflight_headers.update(
            {
                "Access-Control-Allow-Methods": ", ".join(allow_methods),
                "Access-Control-Max-Age": str(max_age),
            }
        )
        allow_headers = sorted(SAFELISTED_HEADERS | set(allow_headers))
-        if allow_headers and "*" not in allow_headers:
+        if allow_headers and not allow_all_headers:


isn't allow_headers redundant here since it's never an empty list? This could be reduced to this, right?:

if not allow_all_headers: ...

Agreed, it looks unused.

Also a bit concerned about headers with mixed case in the Access-Control-Allow-Headers header, but if it is an issue it's a separate one.

JayH5

@jcwilson been meaning to say: this looks good to me, but I don't feel that I have enough experience with CORS to say what the best practices are, especially w.r.t. allow_origins="*". If another member of @encode/maintainers is happy to sign-off on this then so am I. Alternatively, if you can find precedence for this behaviour in any commonly used libraries, especially in the Flask or Django space, that would help.

JayH5 · 2021-04-07T20:37:29Z

starlette/middleware/cors.py

        preflight_headers.update(
            {
                "Access-Control-Allow-Methods": ", ".join(allow_methods),
                "Access-Control-Max-Age": str(max_age),
            }
        )
        allow_headers = sorted(SAFELISTED_HEADERS | set(allow_headers))
-        if allow_headers and "*" not in allow_headers:
+        if allow_headers and not allow_all_headers:


Agreed, it looks unused.

Also a bit concerned about headers with mixed case in the Access-Control-Allow-Headers header, but if it is an issue it's a separate one.

jcwilson · 2021-04-10T17:24:48Z

Alternatively, if you can find precedence for this behaviour in any commonly used libraries, especially in the Flask or Django space, that would help.

Sure thing. Let me get back to you on that. I've been working more closely with the envoy-proxy implementation lately, but I'll see what else I can dig up.

jcwilson · 2021-04-11T02:48:26Z

I don't believe envoy-proxy will ever send back * on preflight requests, regardless of the allow-credentials setting.

Django via django-cors-headers performs nearly identical logic to what this PR contains.

Flask-CORS seems to over-complicate things a bit, but you'd have to specifically force it to try to send the literal * value and even then it checks for that and prevents that misconfiguration. The actual behavior when configured with origins="*" doesn't even look at whether credentials are allowed or not, it will just reflect back the request's origin. (If one were to set send_wildcard to attempt to get it to send *, it would trigger the above error before getting to that point.)

JayH5

Cool, I'm happy with this, especially with the django-cors-headers precedent.

JayH5 · 2021-04-14T19:12:00Z

Thank you!

jcwilson · 2021-04-14T20:52:31Z

Thank you, too. And @euri10

Josh Wilson added 2 commits December 11, 2020 02:21

Add Vary header to preflight response if allow_credentials

1a28cce

JayH5 added the cors Cross-Origin Resource Sharing label Feb 4, 2021

Merge branch 'master' into cors-preflight-allow-credentials

78e3adf

jcwilson mentioned this pull request Apr 5, 2021

Add Origin to Vary header on credentialed CORS response #1111

Merged

Merge branch 'master' into cors-preflight-allow-credentials

a6018d0

This comment has been minimized.

Sign in to view

Josh Wilson added 2 commits April 6, 2021 18:38

Convert MutableHeaders to dict for PlainTextResponse

b100232

jcwilson commented Apr 7, 2021

View reviewed changes

starlette/middleware/cors.py Outdated Show resolved Hide resolved

Josh Wilson added 2 commits April 6, 2021 23:14

Revert back to dict() for preflight headers

496983c

This also names and caches some of the boolean tests in __init__() which we use in later if-blocks. This follows the existing pattern in order to better self-document the code.

Clean up comments

5ee63ac

jcwilson commented Apr 7, 2021

View reviewed changes

Remove unused self.allow_credentials attribute

d15f3b0

JayH5 reviewed Apr 10, 2021

View reviewed changes

JayH5 approved these changes Apr 12, 2021

View reviewed changes

JayH5 merged commit 995d70c into encode:master Apr 14, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Set explicit Origin in CORS preflight response if allow_credentials is True and allow_origins is wildcard #1113

Set explicit Origin in CORS preflight response if allow_credentials is True and allow_origins is wildcard #1113

jcwilson commented Dec 11, 2020 •

edited

Loading

jcwilson commented Apr 7, 2021

jcwilson commented Apr 7, 2021

This comment has been minimized.

jcwilson Apr 7, 2021

JayH5 Apr 7, 2021

JayH5 left a comment

JayH5 Apr 7, 2021

jcwilson commented Apr 10, 2021 •

edited

Loading

jcwilson commented Apr 11, 2021 •

edited

Loading

JayH5 left a comment

JayH5 commented Apr 14, 2021

jcwilson commented Apr 14, 2021

Set explicit Origin in CORS preflight response if allow_credentials is True and allow_origins is wildcard #1113

Set explicit Origin in CORS preflight response if allow_credentials is True and allow_origins is wildcard #1113

Conversation

jcwilson commented Dec 11, 2020 • edited Loading

jcwilson commented Apr 7, 2021

jcwilson commented Apr 7, 2021

This comment has been minimized.

jcwilson Apr 7, 2021

Choose a reason for hiding this comment

JayH5 Apr 7, 2021

Choose a reason for hiding this comment

JayH5 left a comment

Choose a reason for hiding this comment

JayH5 Apr 7, 2021

Choose a reason for hiding this comment

jcwilson commented Apr 10, 2021 • edited Loading

jcwilson commented Apr 11, 2021 • edited Loading

JayH5 left a comment

Choose a reason for hiding this comment

JayH5 commented Apr 14, 2021

jcwilson commented Apr 14, 2021

jcwilson commented Dec 11, 2020 •

edited

Loading

jcwilson commented Apr 10, 2021 •

edited

Loading

jcwilson commented Apr 11, 2021 •

edited

Loading