{"action":"created","comment":{"url":"https://api.github.com/repos/playframework/playframework/pulls/comments/27365531","id":27365531,"diff_hunk":"@@ -0,0 +1,313 @@\n+/*\n+ * Copyright (C) 2009-2013 Typesafe Inc. <http://www.typesafe.com>\n+ */\n+package play.filters.cors\n+\n+import scala.collection.immutable\n+import scala.concurrent.Future\n+\n+import java.net.{ URI, URISyntaxException }\n+\n+import play.api.LoggerLike\n+import play.api.http.{ HeaderNames, HttpVerbs }\n+import play.api.libs.concurrent.Execution.Implicits.defaultContext\n+import play.api.mvc.{ RequestHeader, Results, Result }\n+\n+/**\n+ * An abstraction for providing [[play.api.mvc.Action]]s and [[play.api.mvc.Filter]]s that support Cross-Origin\n+ * Resource Sharing (CORS)\n+ *\n+ * @see [[http://www.w3.org/TR/cors/ CORS specification]]\n+ */\n+trait AbstractCORSPolicy {\n+\n+  protected val logger: LoggerLike\n+\n+  protected def corsConfig: CORSConfig\n+\n+  /**\n+   * HTTP Methods support by Play\n+   */\n+  private val HttpMethods = {\n+    import HttpVerbs._\n+    immutable.HashSet(GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS)\n+  }\n+\n+  protected def filterRequest(f: () => Future[Result], request: RequestHeader): Future[Result] = {\n+    request.headers.get(HeaderNames.ORIGIN) match {\n+      case None =>\n+        /* http://www.w3.org/TR/cors/#resource-requests\n+         * § 6.1.1\n+         * If the Origin header is not present terminate this set of steps.\n+         */\n+        f()\n+      case Some(originHeader) =>\n+        if (originHeader.isEmpty || !isValidOrigin(originHeader)) {\n+          handleInvalidCORSRequest(request)\n+        } else if (request.headers.get(HeaderNames.HOST).map(originHeader.endsWith _).getOrElse(false)) {\n+          // HOST and ORIGIN match, so this is a same-origin request\n+          f()\n+        } else {\n+          val method = request.method\n+          if (HttpMethods.contains(method)) {\n+            if (method == HttpVerbs.OPTIONS) {\n+              request.headers.get(HeaderNames.ACCESS_CONTROL_REQUEST_METHOD) match {\n+                case None =>\n+                  handleCORSRequest(f, request)\n+                case Some(requestMethod) =>\n+                  if (requestMethod.isEmpty) {\n+                    handleInvalidCORSRequest(request)\n+                  } else {\n+                    handlePreFlightCORSRequest(request)\n+                  }\n+              }\n+            } else {\n+              handleCORSRequest(f, request)\n+            }\n+          } else {\n+            // unrecognized method so invalid request\n+            handleInvalidCORSRequest(request)\n+          }\n+        }\n+    }\n+  }\n+\n+  /* Handles a CORS request\n+   *\n+   * @see [[http://www.w3.org/TR/cors/#resource-requests Simple Cross-Origin Request, Actual Request, and Redirects]]\n+   */\n+  private def handleCORSRequest(f: () => Future[Result], request: RequestHeader): Future[Result] = {\n+    val origin = {\n+      val originOpt = request.headers.get(HeaderNames.ORIGIN)\n+      assume(originOpt.isDefined, \"The presence of the ORIGIN header should guaranteed at this point.\")\n+      originOpt.get\n+    }\n+\n+    /* http://www.w3.org/TR/cors/#resource-requests\n+     * § 6.1.2\n+     * If the value of the Origin header is not a case-sensitive match for\n+     * any of the values in list of origins, do not set any additional\n+     * headers and terminate this set of steps.\n+     */\n+    if (!isOriginAllowed(origin)) {\n+      handleInvalidCORSRequest(request)\n+    } else {\n+      val headerBuilder = Seq.newBuilder[(String, String)]\n+\n+      /* http://www.w3.org/TR/cors/#resource-requests\n+       * § 6.1.3\n+       */\n+      if (corsConfig.supportsCredentials) {\n+        /* If the resource supports credentials add a single Access-Control-Allow-Origin header,\n+         * with the value of the Origin header as value, and add a single\n+         * Access-Control-Allow-Credentials header with the case-sensitive string \"true\" as value.\n+         */\n+        headerBuilder += HeaderNames.ACCESS_CONTROL_ALLOW_CREDENTIALS -> \"true\"\n+        headerBuilder += HeaderNames.ACCESS_CONTROL_ALLOW_ORIGIN -> origin\n+        /* http://www.w3.org/TR/cors/#resource-implementation\n+         * § 6.4\n+         * Resources that wish to enable themselves to be shared with multiple Origins but do\n+         * not respond uniformly with \"*\" must in practice generate the Access-Control-Allow-Origin\n+         * header dynamically in response to every request they wish to allow. As a consequence,\n+         * authors of such resources should send a Vary: Origin HTTP header or provide other\n+         * appropriate control directives to prevent caching of such responses, which may be\n+         * inaccurate if re-used across-origins.\n+         */\n+        headerBuilder += HeaderNames.VARY -> HeaderNames.ORIGIN\n+      } else {","path":"framework/src/play-filters-helpers/src/main/scala/play/filters/cors/AbstractCORSPolicy.scala","position":117,"original_position":117,"commit_id":"c9f07295fbf4ae695a2c2310b98ce5df7e14cb54","original_commit_id":"c9f07295fbf4ae695a2c2310b98ce5df7e14cb54","user":{"login":"richdougherty","id":14750,"avatar_url":"https://avatars.githubusercontent.com/u/14750?v=3","gravatar_id":"","url":"https://api.github.com/users/richdougherty","html_url":"https://github.com/richdougherty","followers_url":"https://api.github.com/users/richdougherty/followers","following_url":"https://api.github.com/users/richdougherty/following{/other_user}","gists_url":"https://api.github.com/users/richdougherty/gists{/gist_id}","starred_url":"https://api.github.com/users/richdougherty/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/richdougherty/subscriptions","organizations_url":"https://api.github.com/users/richdougherty/orgs","repos_url":"https://api.github.com/users/richdougherty/repos","events_url":"https://api.github.com/users/richdougherty/events{/privacy}","received_events_url":"https://api.github.com/users/richdougherty/received_events","type":"User","site_admin":false},"body":"At this point we know `corsConfig.supportsCredentials` is `false`. What about blocking the request and returning some 4xx response if we detect any [credentials headers](http://www.w3.org/TR/cors/#user-credentials) in place? Since we know the application doesn't want to support requests that contain credentials it seems like we can make the app safer by blocking the request.","created_at":"2015-03-30T03:47:39Z","updated_at":"2015-03-30T03:47:39Z","html_url":"https://github.com/playframework/playframework/pull/4142#discussion_r27365531","pull_request_url":"https://api.github.com/repos/playframework/playframework/pulls/4142","_links":{"self":{"href":"https://api.github.com/repos/playframework/playframework/pulls/comments/27365531"},"html":{"href":"https://github.com/playframework/playframework/pull/4142#discussion_r27365531"},"pull_request":{"href":"https://api.github.com/repos/playframework/playframework/pulls/4142"}}},"pull_request":{"url":"https://api.github.com/repos/playframework/playframework/pulls/4142","id":32084914,"html_url":"https://github.com/playframework/playframework/pull/4142","diff_url":"https://github.com/playframework/playframework/pull/4142.diff","patch_url":"https://github.com/playframework/playframework/pull/4142.patch","issue_url":"https://api.github.com/repos/playframework/playframework/issues/4142","number":4142,"state":"open","locked":false,"title":"A filter that implements Cross-Origin Resource Sharing (CORS)","user":{"login":"jroper","id":105833,"avatar_url":"https://avatars.githubusercontent.com/u/105833?v=3","gravatar_id":"","url":"https://api.github.com/users/jroper","html_url":"https://github.com/jroper","followers_url":"https://api.github.com/users/jroper/followers","following_url":"https://api.github.com/users/jroper/following{/other_user}","gists_url":"https://api.github.com/users/jroper/gists{/gist_id}","starred_url":"https://api.github.com/users/jroper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jroper/subscriptions","organizations_url":"https://api.github.com/users/jroper/orgs","repos_url":"https://api.github.com/users/jroper/repos","events_url":"https://api.github.com/users/jroper/events{/privacy}","received_events_url":"https://api.github.com/users/jroper/received_events","type":"User","site_admin":false},"body":"This includes #3371, and makes changes to the reference.conf style","created_at":"2015-03-27T05:48:57Z","updated_at":"2015-03-30T03:47:39Z","closed_at":null,"merged_at":null,"merge_commit_sha":"a53dbd8a915be6dc8d4c426827f0fafc5d9a5001","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/playframework/playframework/pulls/4142/commits","review_comments_url":"https://api.github.com/repos/playframework/playframework/pulls/4142/comments","review_comment_url":"https://api.github.com/repos/playframework/playframework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/playframework/playframework/issues/4142/comments","statuses_url":"https://api.github.com/repos/playframework/playframework/statuses/c9f07295fbf4ae695a2c2310b98ce5df7e14cb54","head":{"label":"jroper:3371-cors-filter","ref":"3371-cors-filter","sha":"c9f07295fbf4ae695a2c2310b98ce5df7e14cb54","user":{"login":"jroper","id":105833,"avatar_url":"https://avatars.githubusercontent.com/u/105833?v=3","gravatar_id":"","url":"https://api.github.com/users/jroper","html_url":"https://github.com/jroper","followers_url":"https://api.github.com/users/jroper/followers","following_url":"https://api.github.com/users/jroper/following{/other_user}","gists_url":"https://api.github.com/users/jroper/gists{/gist_id}","starred_url":"https://api.github.com/users/jroper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jroper/subscriptions","organizations_url":"https://api.github.com/users/jroper/orgs","repos_url":"https://api.github.com/users/jroper/repos","events_url":"https://api.github.com/users/jroper/events{/privacy}","received_events_url":"https://api.github.com/users/jroper/received_events","type":"User","site_admin":false},"repo":{"id":5479103,"name":"playframework","full_name":"jroper/playframework","owner":{"login":"jroper","id":105833,"avatar_url":"https://avatars.githubusercontent.com/u/105833?v=3","gravatar_id":"","url":"https://api.github.com/users/jroper","html_url":"https://github.com/jroper","followers_url":"https://api.github.com/users/jroper/followers","following_url":"https://api.github.com/users/jroper/following{/other_user}","gists_url":"https://api.github.com/users/jroper/gists{/gist_id}","starred_url":"https://api.github.com/users/jroper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jroper/subscriptions","organizations_url":"https://api.github.com/users/jroper/orgs","repos_url":"https://api.github.com/users/jroper/repos","events_url":"https://api.github.com/users/jroper/events{/privacy}","received_events_url":"https://api.github.com/users/jroper/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jroper/playframework","description":"Play framework 2.0","fork":true,"url":"https://api.github.com/repos/jroper/playframework","forks_url":"https://api.github.com/repos/jroper/playframework/forks","keys_url":"https://api.github.com/repos/jroper/playframework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jroper/playframework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jroper/playframework/teams","hooks_url":"https://api.github.com/repos/jroper/playframework/hooks","issue_events_url":"https://api.github.com/repos/jroper/playframework/issues/events{/number}","events_url":"https://api.github.com/repos/jroper/playframework/events","assignees_url":"https://api.github.com/repos/jroper/playframework/assignees{/user}","branches_url":"https://api.github.com/repos/jroper/playframework/branches{/branch}","tags_url":"https://api.github.com/repos/jroper/playframework/tags","blobs_url":"https://api.github.com/repos/jroper/playframework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jroper/playframework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jroper/playframework/git/refs{/sha}","trees_url":"https://api.github.com/repos/jroper/playframework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jroper/playframework/statuses/{sha}","languages_url":"https://api.github.com/repos/jroper/playframework/languages","stargazers_url":"https://api.github.com/repos/jroper/playframework/stargazers","contributors_url":"https://api.github.com/repos/jroper/playframework/contributors","subscribers_url":"https://api.github.com/repos/jroper/playframework/subscribers","subscription_url":"https://api.github.com/repos/jroper/playframework/subscription","commits_url":"https://api.github.com/repos/jroper/playframework/commits{/sha}","git_commits_url":"https://api.github.com/repos/jroper/playframework/git/commits{/sha}","comments_url":"https://api.github.com/repos/jroper/playframework/comments{/number}","issue_comment_url":"https://api.github.com/repos/jroper/playframework/issues/comments{/number}","contents_url":"https://api.github.com/repos/jroper/playframework/contents/{+path}","compare_url":"https://api.github.com/repos/jroper/playframework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jroper/playframework/merges","archive_url":"https://api.github.com/repos/jroper/playframework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jroper/playframework/downloads","issues_url":"https://api.github.com/repos/jroper/playframework/issues{/number}","pulls_url":"https://api.github.com/repos/jroper/playframework/pulls{/number}","milestones_url":"https://api.github.com/repos/jroper/playframework/milestones{/number}","notifications_url":"https://api.github.com/repos/jroper/playframework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jroper/playframework/labels{/name}","releases_url":"https://api.github.com/repos/jroper/playframework/releases{/id}","created_at":"2012-08-20T09:08:58Z","updated_at":"2014-09-03T06:49:35Z","pushed_at":"2015-03-29T22:39:20Z","git_url":"git://github.com/jroper/playframework.git","ssh_url":"git@github.com:jroper/playframework.git","clone_url":"https://github.com/jroper/playframework.git","svn_url":"https://github.com/jroper/playframework","homepage":"http://www.playframework.org/","size":73584,"stargazers_count":6,"watchers_count":6,"language":"Scala","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2,"mirror_url":null,"open_issues_count":0,"forks":2,"open_issues":0,"watchers":6,"default_branch":"master"}},"base":{"label":"playframework:master","ref":"master","sha":"c980fb7dfb963226b00218d6bf1ba6930e75cf98","user":{"login":"playframework","id":319107,"avatar_url":"https://avatars.githubusercontent.com/u/319107?v=3","gravatar_id":"","url":"https://api.github.com/users/playframework","html_url":"https://github.com/playframework","followers_url":"https://api.github.com/users/playframework/followers","following_url":"https://api.github.com/users/playframework/following{/other_user}","gists_url":"https://api.github.com/users/playframework/gists{/gist_id}","starred_url":"https://api.github.com/users/playframework/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/playframework/subscriptions","organizations_url":"https://api.github.com/users/playframework/orgs","repos_url":"https://api.github.com/users/playframework/repos","events_url":"https://api.github.com/users/playframework/events{/privacy}","received_events_url":"https://api.github.com/users/playframework/received_events","type":"Organization","site_admin":false},"repo":{"id":2340549,"name":"playframework","full_name":"playframework/playframework","owner":{"login":"playframework","id":319107,"avatar_url":"https://avatars.githubusercontent.com/u/319107?v=3","gravatar_id":"","url":"https://api.github.com/users/playframework","html_url":"https://github.com/playframework","followers_url":"https://api.github.com/users/playframework/followers","following_url":"https://api.github.com/users/playframework/following{/other_user}","gists_url":"https://api.github.com/users/playframework/gists{/gist_id}","starred_url":"https://api.github.com/users/playframework/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/playframework/subscriptions","organizations_url":"https://api.github.com/users/playframework/orgs","repos_url":"https://api.github.com/users/playframework/repos","events_url":"https://api.github.com/users/playframework/events{/privacy}","received_events_url":"https://api.github.com/users/playframework/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/playframework/playframework","description":"Play Framework","fork":false,"url":"https://api.github.com/repos/playframework/playframework","forks_url":"https://api.github.com/repos/playframework/playframework/forks","keys_url":"https://api.github.com/repos/playframework/playframework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/playframework/playframework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/playframework/playframework/teams","hooks_url":"https://api.github.com/repos/playframework/playframework/hooks","issue_events_url":"https://api.github.com/repos/playframework/playframework/issues/events{/number}","events_url":"https://api.github.com/repos/playframework/playframework/events","assignees_url":"https://api.github.com/repos/playframework/playframework/assignees{/user}","branches_url":"https://api.github.com/repos/playframework/playframework/branches{/branch}","tags_url":"https://api.github.com/repos/playframework/playframework/tags","blobs_url":"https://api.github.com/repos/playframework/playframework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/playframework/playframework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/playframework/playframework/git/refs{/sha}","trees_url":"https://api.github.com/repos/playframework/playframework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/playframework/playframework/statuses/{sha}","languages_url":"https://api.github.com/repos/playframework/playframework/languages","stargazers_url":"https://api.github.com/repos/playframework/playframework/stargazers","contributors_url":"https://api.github.com/repos/playframework/playframework/contributors","subscribers_url":"https://api.github.com/repos/playframework/playframework/subscribers","subscription_url":"https://api.github.com/repos/playframework/playframework/subscription","commits_url":"https://api.github.com/repos/playframework/playframework/commits{/sha}","git_commits_url":"https://api.github.com/repos/playframework/playframework/git/commits{/sha}","comments_url":"https://api.github.com/repos/playframework/playframework/comments{/number}","issue_comment_url":"https://api.github.com/repos/playframework/playframework/issues/comments{/number}","contents_url":"https://api.github.com/repos/playframework/playframework/contents/{+path}","compare_url":"https://api.github.com/repos/playframework/playframework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/playframework/playframework/merges","archive_url":"https://api.github.com/repos/playframework/playframework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/playframework/playframework/downloads","issues_url":"https://api.github.com/repos/playframework/playframework/issues{/number}","pulls_url":"https://api.github.com/repos/playframework/playframework/pulls{/number}","milestones_url":"https://api.github.com/repos/playframework/playframework/milestones{/number}","notifications_url":"https://api.github.com/repos/playframework/playframework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/playframework/playframework/labels{/name}","releases_url":"https://api.github.com/repos/playframework/playframework/releases{/id}","created_at":"2011-09-07T09:24:08Z","updated_at":"2015-03-30T03:06:56Z","pushed_at":"2015-03-30T02:58:56Z","git_url":"git://github.com/playframework/playframework.git","ssh_url":"git@github.com:playframework/playframework.git","clone_url":"https://github.com/playframework/playframework.git","svn_url":"https://github.com/playframework/playframework","homepage":"http://www.playframework.com/","size":120340,"stargazers_count":6000,"watchers_count":6000,"language":"Scala","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":2123,"mirror_url":null,"open_issues_count":222,"forks":2123,"open_issues":222,"watchers":6000,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/playframework/playframework/pulls/4142"},"html":{"href":"https://github.com/playframework/playframework/pull/4142"},"issue":{"href":"https://api.github.com/repos/playframework/playframework/issues/4142"},"comments":{"href":"https://api.github.com/repos/playframework/playframework/issues/4142/comments"},"review_comments":{"href":"https://api.github.com/repos/playframework/playframework/pulls/4142/comments"},"review_comment":{"href":"https://api.github.com/repos/playframework/playframework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/playframework/playframework/pulls/4142/commits"},"statuses":{"href":"https://api.github.com/repos/playframework/playframework/statuses/c9f07295fbf4ae695a2c2310b98ce5df7e14cb54"}}}}