channels icon indicating copy to clipboard operation
channels copied to clipboard

OriginValidator could raise exception/log message for denied connections

Open pztrick opened this issue 1 year ago • 1 comments

The OriginValidator and AllowedHostsOriginValidator do not currently log anything to stdout/stderr when requests are denied.

API client tools like Insomnia may not set any Origin header when making a websocket request, or users could have their ALLOWED_HOSTS misconfigured, resulting in this output:

WebSocket HANDSHAKING /ws/echo/ [172.20.0.1:51624]
WebSocket REJECT /ws/echo/ [172.20.0.1:51624]
WebSocket DISCONNECT /ws/echo/ [172.20.0.1:51624]

No information is given for why the request was rejected.

The OriginValidator could output an exception to stderr or another logger similar to its HTTP counter-part django.core.exceptions.DisallowedHost. This would result in friendlier output, e.g.:

WebSocket HANDSHAKING /ws/echo/ [172.20.0.1:51624]
> Invalid Origin header: 'example.com:8621'. You may need to add 'example.com' to ALLOWED_HOSTS.
WebSocket REJECT /ws/echo/ [172.20.0.1:51624]
WebSocket DISCONNECT /ws/echo/ [172.20.0.1:51624]

pztrick avatar Dec 09 '23 12:12 pztrick