Remove this Origin check, please!

dansmith65 · 25 March 2024 18:24

I'm hoping this old comment can be addressed now?

Which affects this code:

laurent22/joplin/blob/f8a25cb275a0beb9ba3ef9bf4271d38947449f42/packages/server/src/utils/routeUtils.ts#L165


      
          	if (basePath) {
          		const schema = [basePath];
          		if (output.id) schema.push(':id');
          		if (output.link) schema.push(output.link);
          		output.schema = schema.join('/');
          	}
          
          	return output;
          }
          
          export function isValidOrigin(requestOrigin: string, endPointBaseUrl: string, routeType: RouteType): boolean {
          	const host1 = (new URL(requestOrigin)).host;
          	const host2 = (new URL(endPointBaseUrl)).host;
          
          	if (routeType === RouteType.UserContent) {
          		// At this point we only check if eg usercontent.com has been accessed
          		// with origin usercontent.com, or something.usercontent.com. We don't
          		// check that the user ID is valid or is event present. This will be
          		// done by the /share end point, which will also check that the share
          		// owner ID matches the origin URL.
          		if (host1 === host2) return true;

As far as I can tell, there is no current documentation that mentions use of anything other than the APP_BASE_URL environment variable. Even though the code does use USER_CONTENT_BASE_URL and API_BASE_URL. Maybe the easy/safe fix is to specify that the origin is valid if none of the other base url environment variables are specified? That way this code will continue to function as designed when different domains are used.

TommyV6 · 23 April 2024 23:27

Yes! Please allow to REMOVE/DISABLE origin check. This is making many problems.

rwijbenga · 19 May 2024 18:36

I would love also to have way to disable this check, any update on this?

MrSimmo · 29 March 2025 09:24

Not a proper fix, but this is the method I used to bypass it in my Docker environment. As with anything that may break or not work or cause damage elsewhere so follow with caution and also double check everything!

Topic		Replies	Views
Invalid Origin error on the server Support	1	37	29 March 2025
Invalid origin: http://127.0.0.1:22300 Support	2	912	6 December 2023
Dabbling with Joplin Server Development	7	1022	21 December 2021
New Install - Invalid origin error Support	18	13384	1 August 2021
Invalid origin error Support	2	122	7 February 2025

Remove this Origin check, please!

Related topics