normalizeOrigin() — fiber Function Reference

Architecture documentation for the normalizeOrigin() function in helpers.go from the fiber codebase.

Function go FiberMiddleware Security

Entity Profile

FiberMiddleware→ Security→ normalizeOrigin() — fiber Function Reference

Dependency Diagram

graph TD
  b807f812_8097_64ea_a03d_51cdfcd24e8b["normalizeOrigin()"]
  fc745a0e_055f_91b6_3e1b_4c868fc3e71b["helpers.go"]
  b807f812_8097_64ea_a03d_51cdfcd24e8b -->|defined in| fc745a0e_055f_91b6_3e1b_4c868fc3e71b
  style b807f812_8097_64ea_a03d_51cdfcd24e8b fill:#6366f1,stroke:#818cf8,color:#fff

Relationship Graph

Source Code

middleware/csrf/helpers.go lines 72–99

func normalizeOrigin(origin string) (valid bool, normalized string) { //nolint:nonamedreturns // gocritic unnamedResult prefers naming validity and normalized origin results
	parsedOrigin, err := url.Parse(origin)
	if err != nil {
		return false, ""
	}

	// Validate the scheme is either http or https
	if parsedOrigin.Scheme != schemeHTTP && parsedOrigin.Scheme != schemeHTTPS {
		return false, ""
	}

	// Don't allow a wildcard with a protocol
	// wildcards cannot be used within any other value. For example, the following header is not valid:
	// Access-Control-Allow-Origin: https://*
	if strings.IndexByte(parsedOrigin.Host, '*') >= 0 {
		return false, ""
	}

	// Validate there is a host present. The presence of a path, query, or fragment components
	// is checked, but a trailing "/" (indicative of the root) is allowed for the path and will be normalized
	if parsedOrigin.Host == "" || (parsedOrigin.Path != "" && parsedOrigin.Path != "/") || parsedOrigin.RawQuery != "" || parsedOrigin.Fragment != "" {
		return false, ""
	}

	// Normalize the origin by constructing it from the scheme and host.
	// The path or trailing slash is not included in the normalized origin.
	return true, utils.ToLower(parsedOrigin.Scheme) + "://" + utils.ToLower(parsedOrigin.Host)
}