Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug with same origin check behind reverse proxies/load balancers etc. #1363

Closed
davidfowl opened this issue Jan 17, 2013 · 1 comment
Closed
Assignees
Milestone

Comments

@davidfowl
Copy link
Member

Found while testing signalr on appharbor. The same origin check is failing for normal requests. This is because we have bad url parsing logic in ServerRequest.Owin, in particular:

https://github.com/SignalR/SignalR/blob/release/src/Microsoft.AspNet.SignalR.Owin/ServerRequest.Owin.cs#L139

The request port should be 80 or 443 if a host header is defined but there's no port as part of the host header.

You can observe the effects here:

http://owindump.apphb.com/env

Doesn't happen on windows azure websites (the port is 80):

http://owintest.azurewebsites.net/env

@ghost ghost assigned davidfowl Jan 17, 2013
davidfowl added a commit that referenced this issue Jan 17, 2013
- Always use the default port if the host header exists but there's no
  port.

#1363
@Xiaohongt
Copy link
Contributor

verified

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants