Remove this Origin check, please!

dansmith65 · 25 March 2024 18:24

I'm hoping this old comment can be addressed now?

Which affects this code:

laurent22/joplin/blob/f8a25cb275a0beb9ba3ef9bf4271d38947449f42/packages/server/src/utils/routeUtils.ts#L165


      
          	if (basePath) {
          		const schema = [basePath];
          		if (output.id) schema.push(':id');
          		if (output.link) schema.push(output.link);
          		output.schema = schema.join('/');
          	}
          
          	return output;
          }
          
          export function isValidOrigin(requestOrigin: string, endPointBaseUrl: string, routeType: RouteType): boolean {
          	const host1 = (new URL(requestOrigin)).host;
          	const host2 = (new URL(endPointBaseUrl)).host;
          
          	if (routeType === RouteType.UserContent) {
          		// At this point we only check if eg usercontent.com has been accessed
          		// with origin usercontent.com, or something.usercontent.com. We don't
          		// check that the user ID is valid or is event present. This will be
          		// done by the /share end point, which will also check that the share
          		// owner ID matches the origin URL.
          		if (host1 === host2) return true;

As far as I can tell, there is no current documentation that mentions use of anything other than the APP_BASE_URL environment variable. Even though the code does use USER_CONTENT_BASE_URL and API_BASE_URL. Maybe the easy/safe fix is to specify that the origin is valid if none of the other base url environment variables are specified? That way this code will continue to function as designed when different domains are used.

TommyV6 · 23 April 2024 23:27

Yes! Please allow to REMOVE/DISABLE origin check. This is making many problems.

Topic		Replies	Views
Dabbling with Joplin Server Development	7	926	21 December 2021
New Install - Invalid origin error Support	18	10877	1 August 2021
Joplin server and Docker error message Development	2	688	4 October 2023
Joplin Server Setup - Invalid origin Support	13	6503	30 July 2021
Joplin Server is not working Support	3	753	6 February 2024

Remove this Origin check, please!

Related Topics