4.x Include scheme and port of origin and host in deciding whether to classify a request as CORS or not

cors/src/main/java/io/helidon/cors/CorsRequestAdapter.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022, 2023 Oracle and/or its affiliates.
+ * Copyright (c) 2022, 2024 Oracle and/or its affiliates.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

cors/src/main/java/io/helidon/cors/CorsSupportHelper.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, 2023 Oracle and/or its affiliates.
+ * Copyright (c) 2020, 2024 Oracle and/or its affiliates.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,6 +29,7 @@
 import java.util.logging.Logger;
 
 import io.helidon.common.config.Config;
+import io.helidon.common.uri.UriInfo;
 import io.helidon.cors.LogHelper.Headers;
 import io.helidon.http.HeaderName;
 import io.helidon.http.HeaderNames;
@@ -369,14 +370,68 @@ public Aggregator aggregator() {
         return aggregator;
     }
 
-    private boolean isRequestTypeNormal(CorsRequestAdapter<Q> requestAdapter, boolean silent) {
+    // For testing
+    static RequestTypeInfo requestType(String originHeader, UriInfo requestedHostUri) {
+        return RequestTypeInfo.create(originHeader, requestedHostUri);
+    }
+
+    /**
+     * Captures intermediate data and the final result in deciding whether a request is a normal (non-CORS) request or not.
+     * <p>
+     *     We want to use the intermediate results for clearer logging if that's turned on without having to recompute it.
+     * </p>
+     * @param originLocation full origin (including scheme and port)
+     * @param hostLocation   full host (including scheme and port)
+     * @param isNormal       whether the origin and host information represent a normal (non-CORS) request
+     */
+    record RequestTypeInfo(String originLocation, String hostLocation, boolean isNormal) {
+
+        static RequestTypeInfo create(String originHeader, UriInfo requestedHostUri) {
+            String originLocation = CorsSupportHelper.originLocation(originHeader);
+            String hostLocation = CorsSupportHelper.hostLocation(requestedHostUri);
+
+            return new RequestTypeInfo(originLocation,
+                                       hostLocation,
+                                       originLocation.equals(hostLocation));
+        }
+    }
+
+    private static boolean isRequestTypeNormal(CorsRequestAdapter<?> requestAdapter, boolean silent) {
+
         // If no origin header or same as host, then just normal
         Optional<String> originOpt = requestAdapter.firstHeader(HeaderNames.ORIGIN);
-        String host = requestAdapter.requestedUri().host();
+        // Fast decision if there is no Origin header.
+        if (originOpt.isEmpty()) {
+            LogHelper.logIsRequestTypeNormalNoOrigin(silent, requestAdapter);
+            return true;
+        }
 
-        boolean result = originOpt.isEmpty() || originOpt.get().contains("://" + host);
-        LogHelper.logIsRequestTypeNormal(result, silent, requestAdapter, originOpt, host);
-        return result;
+        RequestTypeInfo result = requestType(originOpt.get(), requestAdapter.requestedUri());
+        LogHelper.logIsRequestTypeNormal(result.isNormal,
+                                         silent,
+                                         requestAdapter,
+                                         originOpt,
+                                         result.originLocation,
+                                         result.hostLocation);
+        return result.isNormal;
+    }
+
+    private static String originLocation(String origin) {
+        int originEndOfScheme = origin.indexOf(':');
+        int originLastColon = origin.lastIndexOf(':');
+
+        return origin + (
+                (originEndOfScheme == originLastColon)
+                        ? ":" + portForScheme(origin.substring(0, originEndOfScheme))
+                        : "");
+    }
+
+    private static String hostLocation(UriInfo requestedUri) {
+        return requestedUri.scheme() + "://" + requestedUri.host() + ":" + requestedUri.port();
+    }
+
+    private static String portForScheme(String origin) {
+        return origin.startsWith("https") ? "443" : "80";
     }
 
     private RequestType inferCORSRequestType(CorsRequestAdapter<Q> requestAdapter, boolean silent) {

cors/src/main/java/io/helidon/cors/LogHelper.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, 2023 Oracle and/or its affiliates.
+ * Copyright (c) 2020, 2024 Oracle and/or its affiliates.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -68,8 +68,19 @@ void setAndLog(BiConsumer<HeaderName, Object> consumer, String note) {
         }
     }
 
+
+    static <T> void logIsRequestTypeNormalNoOrigin(boolean silent, CorsRequestAdapter<T> requestAdapter) {
+        if (silent || !CorsSupportHelper.LOGGER.isLoggable(DECISION_LEVEL)) {
+            return;
+        }
+        CorsSupportHelper.LOGGER.log(DECISION_LEVEL,
+                                     String.format("Request %s is not cross-host: %s",
+                                                   requestAdapter,
+                                                   List.of("header " + HeaderNames.ORIGIN + " is absent")));
+    }
+
     static <T> void logIsRequestTypeNormal(boolean result, boolean silent, CorsRequestAdapter<T> requestAdapter,
-            Optional<String> originOpt, String host) {
+            Optional<String> originOpt, String effectiveOrigin, String host) {
         if (silent || !CorsSupportHelper.LOGGER.isLoggable(DECISION_LEVEL)) {
             return;
         }
@@ -81,7 +92,7 @@ static <T> void logIsRequestTypeNormal(boolean result, boolean silent, CorsReque
         if (originOpt.isEmpty()) {
             reasonsWhyNormal.add("header " + HeaderNames.ORIGIN + " is absent");
         } else {
-            factorsWhyCrossHost.add(String.format("header %s is present (%s)", HeaderNames.ORIGIN, originOpt.get()));
+            factorsWhyCrossHost.add(String.format("header %s is present (%s)", HeaderNames.ORIGIN, effectiveOrigin));
         }
 
         if (host.isEmpty()) {
@@ -95,10 +106,10 @@ static <T> void logIsRequestTypeNormal(boolean result, boolean silent, CorsReque
             if (originOpt.get()
                     .contains(partOfOriginMatchingHost)) {
                 reasonsWhyNormal.add(String.format("header %s '%s' matches header %s '%s'", HeaderNames.ORIGIN,
-                                                   originOpt.get(), HeaderNames.HOST, host));
+                                                   effectiveOrigin, HeaderNames.HOST, host));
             } else {
                 factorsWhyCrossHost.add(String.format("header %s '%s' does not match header %s '%s'", HeaderNames.ORIGIN,
-                                                      originOpt.get(), HeaderNames.HOST, host));
+                                                      effectiveOrigin, HeaderNames.HOST, host));
             }
         }