#1473 Module OAuth2 Server: add support for Cross-Origin Resource Sharing (CORS)

modules/boonex/oauth2/classes/BxOAuthDb.php

@@ -113,6 +113,10 @@ class BxOAuthDb extends BxDolModuleDb
         return $this->getOne("SELECT `user_id` FROM `bx_oauth_refresh_tokens` WHERE `client_id` = ? AND `user_id` IN (" . $this->implode_escape($aIds) . ") LIMIT 1", array($sClientId));
     }
 
+    function getClientByAllowedOriginUrl($sUrl)
+    {
+        return $this->getRow("SELECT `c`.* FROM `bx_oauth_clients` AS `c` INNER JOIN `bx_oauth_allowed_origins` AS `o` ON (`o`.`client_id` = `c`.`id`) WHERE `o`.`url` = :url", array('url' => $sUrl));
+    }    
 }
 
 /** @} */

modules/boonex/oauth2/classes/BxOAuthModule.php

@@ -63,49 +63,43 @@ class BxOAuthModule extends BxDolModule
     public function initOAuth($sClientId)
     {
         if ($this->_oStorage)
-            return;
+            return;        
 
-        // get the client data
-         
-        $aClient = $sClientId ? $this->_oDb->getClientsBy(array('type' => 'client_id', 'client_id' => $sClientId)) : false;
-        if (!$aClient)
-            $aClient = array(
-                'cors' => '',
-                'grant_types' => 'authorization_code',
-            );
-        
-        if (!$aClient['grant_types'])
-            $aClient['grant_types'] = 'authorization_code';
-        
-        $aGrantTypes = explode(',', $aClient['grant_types']);
+        $aClient = array();
 
-        // send CORS headers if necessary
+        // check cross origin request
+        
+        if (isset($_SERVER['HTTP_ORIGIN']) && parse_url($_SERVER['HTTP_ORIGIN'], PHP_URL_HOST) != parse_url(BX_DOL_URL_ROOT, PHP_URL_HOST)) {
 
-        if (!empty($aClient['cors']) && isset($_SERVER['HTTP_ORIGIN'])) {
-            
-            if ('*' == trim($aClient['cors']) || (($a = explode(',', $aClient['cors'])) && in_array($_SERVER['HTTP_ORIGIN'], $a))) {
-                $sACAO = $_SERVER['HTTP_ORIGIN'];
-            }
-            else {
+            $aClient = $this->_oDb->getClientByAllowedOriginUrl($_SERVER['HTTP_ORIGIN']);
+            if (!$aClient) {
                 header('HTTP/1.0 403 Forbidden');
                 echo _t("_Access denied");
                 exit;
-            }
-
-            if ("OPTIONS" == $_SERVER['REQUEST_METHOD']) {
-                header('Access-Control-Allow-Origin: ' . $sACAO);
+            } 
+            
+            if ('OPTIONS' == $_SERVER['REQUEST_METHOD']) {
                 header('Access-Control-Allow-Methods: POST, GET');
-                header('Access-Control-Allow-Credentials: true');
-                header('Access-Control-Allow-Headers: Authorization, Content-Type, X-Custom-Header, X-Requested-With');
-                header('Access-Control-Max-Age: 1');  //1728000
-                header("Content-Length: 0");
-                header("Content-Type: application/json");
+                header('Access-Control-Allow-Headers: Authorization, Content-Type, X-Custom-Header, X-Requested-With');                    
                 exit(0);
             }
-
-            header('Access-Control-Allow-Origin: '. $sACAO);
+            header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);
         }
 
+        // get the client data if it wasn't set before
+        
+        if (empty($aClient))
+            $aClient = $sClientId ? $this->_oDb->getClientsBy(array('type' => 'client_id', 'client_id' => $sClientId)) : false;
+        
+        if (!$aClient)
+            $aClient = array('grant_types' => 'authorization_code');
+        
+        if (!$aClient['grant_types'])
+            $aClient['grant_types'] = 'authorization_code';
+        
+        $aGrantTypes = explode(',', $aClient['grant_types']);
+
+
         // configure OAuth storage and server
                 
         $aConfig = array (
@@ -133,7 +127,7 @@ class BxOAuthModule extends BxDolModule
         ));
 
         // add grand types
-                
+
         // Add the "Client Credentials" grant type (it is the simplest of the grant types)
         if (in_array('client_credentials', $aGrantTypes))
             $this->_oServer->addGrantType(new OAuth2\GrantType\ClientCredentials($this->_oStorage));

modules/boonex/oauth2/install/sql/install.sql

@@ -27,13 +27,20 @@ CREATE TABLE IF NOT EXISTS `bx_oauth_clients` (
   `redirect_uri` varchar(255) NOT NULL,
   `grant_types` varchar(80) DEFAULT NULL,
   `scope` varchar(255) DEFAULT NULL,
-  `cors` text NOT NULL,
   `parent_id` int(10) unsigned DEFAULT 0,
   `user_id` int(10) unsigned DEFAULT 0,
   PRIMARY KEY (`id`),
   UNIQUE KEY `client_id` (`client_id`)
 );
 
+CREATE TABLE IF NOT EXISTS `bx_oauth_allowed_origins` (
+  `id` int(11) NOT NULL AUTO_INCREMENT,
+  `client_id` int(11) NOT NULL,
+  `url` varchar(255) NOT NULL,
+  PRIMARY KEY (`id`),
+  KEY `url` (`url`(191))
+);
+
 CREATE TABLE IF NOT EXISTS `bx_oauth_refresh_tokens` (
   `refresh_token` varchar(40) NOT NULL,
   `client_id` varchar(80) NOT NULL,

modules/boonex/oauth2/install/sql/uninstall.sql

@@ -1,5 +1,5 @@
 
-DROP TABLE IF EXISTS `bx_oauth_access_tokens`, `bx_oauth_authorization_codes`, `bx_oauth_clients`, `bx_oauth_refresh_tokens`, `bx_oauth_scopes`;
+DROP TABLE IF EXISTS `bx_oauth_access_tokens`, `bx_oauth_authorization_codes`, `bx_oauth_clients`, `bx_oauth_allowed_origins`, `bx_oauth_refresh_tokens`, `bx_oauth_scopes`;
 
 -- Studio page and widget