Merge pull request #281 from roncohen/6.0-CORS-backport

Backport to 6.0: support OPTIONS method needed for preflight browser requests (#244)

Author: roncohen

_meta/beat.reference.yml

@@ -20,3 +20,9 @@ apm-server:
   #ssl.enabled: false
   #ssl.certificate : "path/to/cert"
   #ssl.key : "path/to/private_key"
+
+  # Comma separated list of permitted origins for frontend. User-agents will send
+  # a origin header that will be validated against this list.
+  # An origin is made of a protocol scheme, host and port, without the url path.
+  # If an item in the list is a single *, everything will be allowed
+  #allow_origins : *

apm-server.reference.yml

@@ -21,6 +21,12 @@ apm-server:
   #ssl.certificate : "path/to/cert"
   #ssl.key : "path/to/private_key"
 
+  # Comma separated list of permitted origins for frontend. User-agents will send
+  # a origin header that will be validated against this list.
+  # An origin is made of a protocol scheme, host and port, without the url path.
+  # If an item in the list is a single *, everything will be allowed
+  #allow_origins : *
+
 #================================ General ======================================
 
 # The name of the shipper that publishes the network data. It can be used to group

beater/config.go

@@ -15,6 +15,7 @@ type Config struct {
 	SSL                *SSLConfig    `config:"ssl"`
 	ConcurrentRequests int           `config:"concurrent_requests" validate:"min=1"`
 	EnableFrontend     bool          `config:"enable_frontend"`
+	AllowOrigins       []string      `config:"allow_origins"`
 }
 
 type SSLConfig struct {
@@ -36,4 +37,5 @@ var defaultConfig = Config{
 	WriteTimeout:       2 * time.Second,
 	ShutdownTimeout:    5 * time.Second,
 	SecretToken:        "",
+	AllowOrigins:       []string{"*"},
 }

beater/handlers.go

@@ -29,6 +29,9 @@ const (
 	BackendErrorsURL        = "/v1/errors"
 	FrontendErrorsURL       = "/v1/client-side/errors"
 	HealthCheckURL          = "/healthcheck"
+
+	supportedHeaders = "Content-Type, Content-Encoding, Accept"
+	supportedMethods = "POST, OPTIONS"
 )
 
 type ProcessorFactory func() processor.Processor
@@ -79,7 +82,8 @@ func backendHandler(pf ProcessorFactory, config Config, report reporter) http.Ha
 func frontendHandler(pf ProcessorFactory, config Config, report reporter) http.Handler {
 	return logHandler(
 		frontendSwitchHandler(config.EnableFrontend,
-			processRequestHandler(pf, config, report)))
+			corsHandler(config.AllowOrigins,
+				processRequestHandler(pf, config, report))))
 }
 
 func healthCheckHandler(_ ProcessorFactory, _ Config, _ reporter) http.Handler {
@@ -133,6 +137,55 @@ func isAuthorized(req *http.Request, secretToken string) bool {
 	return subtle.ConstantTimeCompare([]byte(parts[1]), []byte(secretToken)) == 1
 }
 
+func corsHandler(allowedOrigins []string, h http.Handler) http.Handler {
+
+	var isAllowed = func(origin string) bool {
+		for _, allowed := range allowedOrigins {
+			if origin == allowed || allowed == "*" {
+				return true
+			}
+		}
+		return false
+	}
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+
+		// origin header is always set by the browser
+		origin := r.Header.Get("Origin")
+		validOrigin := isAllowed(origin)
+
+		if r.Method == "OPTIONS" {
+
+			// setting the ACAO header is the way to tell the browser to go ahead with the request
+			if validOrigin {
+				// do not set the configured origin(s), echo the received origin instead
+				w.Header().Set("Access-Control-Allow-Origin", origin)
+			}
+
+			// tell browsers to cache response requestHeaders for up to 1 hour (browsers might ignore this)
+			w.Header().Set("Access-Control-Max-Age", "3600")
+			// origin must be part of the cache key so that we can handle multiple allowed origins
+			w.Header().Set("Vary", "Origin")
+
+			// required if Access-Control-Request-Method and Access-Control-Request-Headers are in the requestHeaders
+			w.Header().Set("Access-Control-Allow-Methods", supportedMethods)
+			w.Header().Set("Access-Control-Allow-Headers", supportedHeaders)
+
+			w.Header().Set("Content-Length", "0")
+
+			sendStatus(w, r, 200, nil)
+
+		} else if validOrigin {
+			// we need to check the origin and set the ACAO header in both the OPTIONS preflight and the actual request
+			w.Header().Set("Access-Control-Allow-Origin", origin)
+			h.ServeHTTP(w, r)
+
+		} else {
+			sendStatus(w, r, 403, errForbidden)
+		}
+	})
+}
+
 func processRequestHandler(pf ProcessorFactory, config Config, report reporter) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		code, err := processRequest(r, pf, config.MaxUnzippedSize, report)

beater/server_test.go

@@ -72,14 +72,31 @@ func TestServerFrontendSwitch(t *testing.T) {
 
 	rec := httptest.NewRecorder()
 	apm.Handler.ServeHTTP(rec, req)
+	apm.Handler = newMuxer(Config{EnableFrontend: false, AllowOrigins: []string{"*"}}, nil)
 	assert.Equal(t, 403, rec.Code, rec.Body.String())
 
-	apm.Handler = newMuxer(Config{EnableFrontend: true}, nil)
+	apm.Handler = newMuxer(Config{EnableFrontend: true, AllowOrigins: []string{"*"}}, nil)
 	rec = httptest.NewRecorder()
 	apm.Handler.ServeHTTP(rec, req)
 	assert.NotEqual(t, 403, rec.Code, rec.Body.String())
 }
 
+func TestServerCORS(t *testing.T) {
+	apm, teardown := setupServer(t, noSSL)
+	defer teardown()
+
+	req, _ := http.NewRequest("POST", FrontendTransactionsURL, bytes.NewReader(testData))
+
+	apm.Handler = newMuxer(Config{EnableFrontend: true,
+		AllowOrigins: []string{"http://notmydomain.com", "http://neitherthisone.com"}},
+		nil)
+
+	rec := httptest.NewRecorder()
+	apm.Handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, 403, rec.Code, rec.Body.String())
+}
+
 func TestServerNoContentType(t *testing.T) {
 	apm, teardown := setupServer(t, noSSL)
 	defer teardown()

tests/system/apmserver.py

@@ -79,6 +79,14 @@ def config(self):
         return cfg
 
 
+class CorsBaseTest(ClientSideBaseTest):
+
+    def config(self):
+        cfg = super(CorsBaseTest, self).config()
+        cfg.update({"allow_origins": ["http://www.elastic.co"]})
+        return cfg
+
+
 class ElasticTest(ServerBaseTest):
 
     @classmethod

tests/system/config/apm-server.yml.j2

@@ -4,6 +4,7 @@ apm-server:
   host: "localhost:8200"
   secret_token: {{ secret_token }}
   enable_frontend: {{ enable_frontend }}
+  allow_origins: {{ allow_origins }}
   ssl.enabled: {{ ssl_enabled }}
   ssl.certificate:  {{ ssl_cert }}
   ssl.key: {{ ssl_key }}

tests/system/test_requests.py

@@ -1,6 +1,6 @@
 from nose.tools import raises
 
-from apmserver import ServerBaseTest, SecureServerBaseTest, ClientSideBaseTest
+from apmserver import ServerBaseTest, SecureServerBaseTest, ClientSideBaseTest, CorsBaseTest
 from requests.exceptions import SSLError
 import requests
 import json
@@ -129,3 +129,47 @@ def test_ok(self):
         transactions = self.get_transaction_payload()
         r = requests.post(self.transactions_url, json=transactions)
         assert r.status_code == 202, r.status_code
+
+
+class CorsTest(CorsBaseTest):
+
+    def test_ok(self):
+        transactions = self.get_transaction_payload()
+        r = requests.post(self.transactions_url, json=transactions, headers={'Origin': 'http://www.elastic.co'})
+        assert r.headers['Access-Control-Allow-Origin'] == 'http://www.elastic.co', r.headers
+        assert r.status_code == 202, r.status_code
+
+    def test_bad_origin(self):
+        # origin must include protocol and match exactly the allowed origin
+        transactions = self.get_transaction_payload()
+        r = requests.post(self.transactions_url, json=transactions, headers={'Origin': 'www.elastic.co'})
+        assert r.status_code == 403, r.status_code
+
+    def test_no_origin(self):
+        transactions = self.get_transaction_payload()
+        r = requests.post(self.transactions_url, json=transactions)
+        assert r.status_code == 403, r.status_code
+
+    def test_preflight(self):
+        transactions = self.get_transaction_payload()
+        r = requests.options(self.transactions_url,
+                             json=transactions,
+                             headers={'Origin': 'http://www.elastic.co',
+                                      'Access-Control-Request-Method': 'POST',
+                                      'Access-Control-Request-Headers': 'Content-Type, Content-Encoding'})
+        assert r.status_code == 200, r.status_code
+        assert r.headers['Access-Control-Allow-Origin'] == 'http://www.elastic.co', r.headers
+        assert r.headers['Access-Control-Allow-Headers'] == 'Content-Type, Content-Encoding, Accept', r.headers
+        assert r.headers['Access-Control-Allow-Methods'] == 'POST, OPTIONS', r.headers
+        assert r.headers['Vary'] == 'Origin', r.headers
+        assert r.headers['Content-Length'] == '0', r.headers
+        assert r.headers['Access-Control-Max-Age'] == '3600', r.headers
+
+    def test_preflight_bad_headers(self):
+        transactions = self.get_transaction_payload()
+        for h in [{'Access-Control-Request-Method': 'POST'}, {'Origin': 'www.elastic.co'}]:
+            r = requests.options(self.transactions_url, json=transactions, headers=h)
+            assert r.status_code == 200, r.status_code
+            assert 'Access-Control-Allow-Origin' not in r.headers.keys(), r.headers
+            assert r.headers['Access-Control-Allow-Headers'] == 'Content-Type, Content-Encoding, Accept', r.headers
+            assert r.headers['Access-Control-Allow-Methods'] == 'POST, OPTIONS', r.headers