aboutsummaryrefslogtreecommitdiff
path: root/src/org/traccar/api
diff options
context:
space:
mode:
authorAnton Tananaev <anton.tananaev@gmail.com>2016-02-27 10:32:11 +1300
committerAnton Tananaev <anton.tananaev@gmail.com>2016-02-27 10:32:11 +1300
commit4b2c0d922ba422a696579fa9d083b98da51f6861 (patch)
treecf891c36c21cda9a20fbae616ab0269c888b6cd1 /src/org/traccar/api
parent53fa46d769168f4f97745412e3ff241843d0851b (diff)
parent002443ba33bbf9883d54505119c5361897d30f66 (diff)
downloadtraccar-server-4b2c0d922ba422a696579fa9d083b98da51f6861.tar.gz
traccar-server-4b2c0d922ba422a696579fa9d083b98da51f6861.tar.bz2
traccar-server-4b2c0d922ba422a696579fa9d083b98da51f6861.zip
Merge branch rsmithsa-RS-CORS-Origin
Diffstat (limited to 'src/org/traccar/api')
-rw-r--r--src/org/traccar/api/CorsResponseFilter.java8
-rw-r--r--src/org/traccar/api/SecurityRequestFilter.java5
2 files changed, 9 insertions, 4 deletions
diff --git a/src/org/traccar/api/CorsResponseFilter.java b/src/org/traccar/api/CorsResponseFilter.java
index ed6e482ae..01d100d0a 100644
--- a/src/org/traccar/api/CorsResponseFilter.java
+++ b/src/org/traccar/api/CorsResponseFilter.java
@@ -37,7 +37,7 @@ public class CorsResponseFilter implements ContainerResponseFilter {
public static final String ACCESS_CONTROL_ALLOW_CREDENTIALS_VALUE = "true";
public static final String ACCESS_CONTROL_ALLOW_METHODS_KEY = "Access-Control-Allow-Methods";
- public static final String ACCESS_CONTROL_ALLOW_METHODS_VALUE = "GET, POST, PUT, DELETE";
+ public static final String ACCESS_CONTROL_ALLOW_METHODS_VALUE = "GET, POST, PUT, DELETE, OPTIONS";
@Override
public void filter(ContainerRequestContext request, ContainerResponseContext response) throws IOException {
@@ -54,11 +54,11 @@ public class CorsResponseFilter implements ContainerResponseFilter {
if (!response.getHeaders().containsKey(ACCESS_CONTROL_ALLOW_ORIGIN_KEY)) {
String origin = request.getHeaderString(HttpHeaders.Names.ORIGIN);
String allowed = Context.getConfig().getString("web.origin");
+
if (allowed == null || origin == null) {
response.getHeaders().add(ACCESS_CONTROL_ALLOW_ORIGIN_KEY, ACCESS_CONTROL_ALLOW_ORIGIN_VALUE);
- } else if (allowed.contains(origin)) {
- String originSafe = URLEncoder.encode(origin, StandardCharsets.UTF_8.name());
- response.getHeaders().add(ACCESS_CONTROL_ALLOW_ORIGIN_KEY, originSafe);
+ } else if (allowed.equals(ACCESS_CONTROL_ALLOW_ORIGIN_VALUE) || allowed.contains(origin)) {
+ response.getHeaders().add(ACCESS_CONTROL_ALLOW_ORIGIN_KEY, origin);
}
}
}
diff --git a/src/org/traccar/api/SecurityRequestFilter.java b/src/org/traccar/api/SecurityRequestFilter.java
index 20186b0cb..d4fb15059 100644
--- a/src/org/traccar/api/SecurityRequestFilter.java
+++ b/src/org/traccar/api/SecurityRequestFilter.java
@@ -55,6 +55,11 @@ public class SecurityRequestFilter implements ContainerRequestFilter {
@Override
public void filter(ContainerRequestContext requestContext) {
+
+ if (requestContext.getMethod() == "OPTIONS") {
+ throw new WebApplicationException(Response.status(Response.Status.OK).entity("").build());
+ }
+
SecurityContext securityContext = null;
String authHeader = requestContext.getHeaderString(AUTHORIZATION_HEADER);