image/caddy
1
0 Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2026-11-11 19:37:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

admin: fix origin comparison

Browse Source 
Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
This commit is contained in:
Mohammed Al Sahaf committed 2026-10-19 11:19:15 +03:00
1 parent 322d778f81
commit 3da00b296a
1 file changed
+14 -2
Download Patch File Download Diff File Expand all files Collapse all files
admin_security_test.go
+14 -2
View File
@@ -90,12 +90,24 @@ func TestAdminHandlerOriginAllowed(t *testing.T) {
want: true,
},
{
// Per RFC 3986 section 3.2.2, host names are case-insensitive.
name: "case-sensitive host comparison (potential RFC 3986 deviation)",
// Per RFC 3986 §3.2.2, host names are case-insensitive.
name: "host comparison is case-insensitive (allow-list uppercase)",
allowedOrigins: []*url.URL{mustParseURL(t, "http://Example.com:8080")},
origin: mustParseURL(t, "http://example.com:8080"),
want: true,
},
{
name: "host comparison is case-insensitive (origin uppercase)",
allowedOrigins: []*url.URL{mustParseURL(t, "http://example.com:8080")},
origin: mustParseURL(t, "http://EXAMPLE.com:8080"),
want: true,
},
{
name: "host comparison is case-insensitive (mixed case)",
allowedOrigins: []*url.URL{mustParseURL(t, "http://Foo.Bar.Example.com:8080")},
origin: mustParseURL(t, "http://foo.bar.example.COM:8080"),
want: true,
},
}
for _, tc := range tests {