Remove this Origin check, please!

dansmith65 · 25 March 2024 18:24

I'm hoping this old comment can be addressed now?

Which affects this code:

laurent22/joplin/blob/f8a25cb275a0beb9ba3ef9bf4271d38947449f42/packages/server/src/utils/routeUtils.ts#L165


      
          	if (basePath) {
          		const schema = [basePath];
          		if (output.id) schema.push(':id');
          		if (output.link) schema.push(output.link);
          		output.schema = schema.join('/');
          	}
          
          	return output;
          }
          
          export function isValidOrigin(requestOrigin: string, endPointBaseUrl: string, routeType: RouteType): boolean {
          	const host1 = (new URL(requestOrigin)).host;
          	const host2 = (new URL(endPointBaseUrl)).host;
          
          	if (routeType === RouteType.UserContent) {
          		// At this point we only check if eg usercontent.com has been accessed
          		// with origin usercontent.com, or something.usercontent.com. We don't
          		// check that the user ID is valid or is event present. This will be
          		// done by the /share end point, which will also check that the share
          		// owner ID matches the origin URL.
          		if (host1 === host2) return true;

As far as I can tell, there is no current documentation that mentions use of anything other than the APP_BASE_URL environment variable. Even though the code does use USER_CONTENT_BASE_URL and API_BASE_URL. Maybe the easy/safe fix is to specify that the origin is valid if none of the other base url environment variables are specified? That way this code will continue to function as designed when different domains are used.

TommyV6 · 23 April 2024 23:27

Yes! Please allow to REMOVE/DISABLE origin check. This is making many problems.

rwijbenga · 19 May 2024 18:36

I would love also to have way to disable this check, any update on this?

Topic		Replies	Views
Invalid origin: http://127.0.0.1:22300 Support	2	820	6 December 2023
Dabbling with Joplin Server Development	7	1003	21 December 2021
New Install - Invalid origin error Support	18	12710	1 August 2021
Joplin server and Docker error message Development	2	933	4 October 2023
Joplin Server Setup - Invalid origin Support	13	7524	30 July 2021

Remove this Origin check, please!

Related topics