diff --git a/http/config.go b/http/config.go index 7c661871e99b6b984569421ccfb52d855e5fedf3..69a0263644e3da8d6f625429dc063834e96ecae7 100644 --- a/http/config.go +++ b/http/config.go @@ -176,5 +176,12 @@ func allowUserAgent(r *http.Request, cfg *ServerConfig) bool { // This means the request probably came from a browser and thus, it // should have included Origin or referer headers. ua := r.Header.Get("User-agent") + + // The fetch API in the Electron Renderer process sends no referer or + // origin but should be allowed + if strings.Contains(ua, "Electron") { + return true + } + return !strings.HasPrefix(ua, "Mozilla") } diff --git a/http/errors_test.go b/http/errors_test.go index e0ece23ec089d2d0c4174b020cb4130707dd49a2..2cef1b04a3611b8df94b835b9f884a2b28895533 100644 --- a/http/errors_test.go +++ b/http/errors_test.go @@ -203,6 +203,15 @@ func TestDisallowedUserAgents(t *testing.T) { "User-Agent": "Mozilla/5.0 (Linux; U; Android 4.1.1; en-gb; Build/KLP) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30", }, }, + { + // Do not block the Electron Renderer process + Method: "POST", + AllowGet: false, + Code: http.StatusOK, + ReqHeaders: map[string]string{ + "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.104 Electron/9.0.4 Safari/537.36", + }, + }, } for _, tc := range tcs {