This is an automated email from the ASF dual-hosted git repository. hsluoyz pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/casbin-gateway.git
commit 4ea45e6cf7a34533b5e94306dafa913c9a3566e2 Author: Yang Luo <[email protected]> AuthorDate: Fri Sep 4 16:09:55 2026 +0800 fix(origin): point the refusal message at the Settings page URL --- routers/origin.go | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/routers/origin.go b/routers/origin.go index ce1696a..37fbadc 100644 --- a/routers/origin.go +++ b/routers/origin.go @@ -40,8 +40,8 @@ import ( func OriginFilter(ctx *context.Context) { host := ctx.Request.Host if !isAllowedHost(host) { - denyOrigin(ctx, fmt.Sprintf("%q is not a name this Gateway answers to; add it to \"Allowed hosts\" on the Settings page to reach Gateway under that name", - hostnameOf(host))) + denyOrigin(ctx, fmt.Sprintf("%q is not a name this Gateway answers to; add it to \"Allowed hosts\" on the Settings page (%s) to reach Gateway under that name", + hostnameOf(host), settingsUrl())) return } @@ -50,7 +50,8 @@ func OriginFilter(ctx *context.Context) { return } if !isAllowedOrigin(origin) && !isAllowedExtensionCall(ctx, origin) { - denyOrigin(ctx, fmt.Sprintf("%s is another site, and Gateway is not callable from one; add it to \"Allowed origins\" on the Settings page to allow it", origin)) + denyOrigin(ctx, fmt.Sprintf("%s is another site, and Gateway is not callable from one; add it to \"Allowed origins\" on the Settings page (%s) to allow it", + origin, settingsUrl())) return } @@ -62,6 +63,20 @@ func OriginFilter(ctx *context.Context) { } } +// settingsUrl is where the two lists are edited. It is built from the address +// Gateway binds to rather than from the Host header, which is the very thing a +// refused request cannot be trusted about. +func settingsUrl() string { + addr := conf.GetHttpAddr() + if addr == "0.0.0.0" || addr == "::" { + addr = "localhost" + } + if ip := net.ParseIP(addr); ip != nil && ip.To4() == nil { + addr = "[" + addr + "]" + } + return fmt.Sprintf("http://%s:%d/settings#network";, addr, conf.GetHttpPort()) +} + func denyOrigin(ctx *context.Context, message string) { ctx.Output.SetStatus(http.StatusForbidden) responseError(ctx, message) --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
