Method determineCORSBehavior

coderd/workspaceapps/proxy.go:363–390

determineCORSBehavior examines the given token and conditionally applies CORS middleware if the token specifies that behavior.

(token *SignedToken, app appurl.ApplicationURL)

// determineCORSBehavior examines the given token and conditionally applies
// CORS middleware if the token specifies that behavior.
func (s *Server) determineCORSBehavior(token *SignedToken, app appurl.ApplicationURL) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		// Create the CORS middleware handler upfront.
		corsHandler := httpmw.WorkspaceAppCors(s.HostnameRegex, app)(next)

		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
			var behavior codersdk.CORSBehavior
			if token != nil {
				behavior = token.CORSBehavior
			}

			// Add behavior to context regardless of which handler we use,
			// since we will use this later on to determine if we should strip
			// CORS headers in the response.
			r = r.WithContext(cors.WithBehavior(r.Context(), behavior))

			switch behavior {
			case codersdk.CORSBehaviorPassthru:
				// Bypass the CORS middleware.
				next.ServeHTTP(rw, r)
				return
			default:
				// Apply the CORS middleware.
				corsHandler.ServeHTTP(rw, r)
			}
		})
	}
}

// HandleSubdomain handles subdomain-based application proxy requests (aka.
// DevURLs in Coder V1).