Madiator2011/lbry-sdk
1
0
Fork 0
forked from LBRYCommunity/lbry-sdk
Code Pull requests Activity

add allowed_origin to config

Browse source 
-raise 403 error if a request doesn't have a matching origin
This commit is contained in:
Jack Robison 2020-05-25 10:02:13 -04:00 • committed by Lex Berezhny
parent f975ea99cb
commit 08d37a4b0f
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
lbry/conf.py
View file

@ -625,6 +625,7 @@ class Config(CLIConfig):
previous_names=['upload_log', 'upload_log', 'share_debug_info'] previous_names=['upload_log', 'upload_log', 'share_debug_info']
) )
track_bandwidth = Toggle("Track bandwidth usage", True) track_bandwidth = Toggle("Track bandwidth usage", True)
allowed_origin = String("Allowed origin header for api calls, use * to allow all", 'null')
# media server # media server
streaming_server = String('Host name and port to serve streaming media over range requests', streaming_server = String('Host name and port to serve streaming media over range requests',

5
lbry/extras/daemon/daemon.py
View file

@ -566,6 +566,11 @@ class Daemon(metaclass=JSONRPCServerType):
log.info("finished shutting down") log.info("finished shutting down")
async def handle_old_jsonrpc(self, request): async def handle_old_jsonrpc(self, request):
origin = request.headers.get('Origin', 'null')
origin = None if origin == 'null' else origin
if origin != self.conf.allowed_origin != '*':
log.warning("API request from origin '%s' is not allowed", origin)
raise web.HTTPForbidden()
data = await request.json() data = await request.json()
params = data.get('params', {}) params = data.get('params', {})
include_protobuf = params.pop('include_protobuf', False) if isinstance(params, dict) else False include_protobuf = params.pop('include_protobuf', False) if isinstance(params, dict) else False