From 7fcbe30b3c47052fd5b57d6c048eab63bb8a6d9d Mon Sep 17 00:00:00 2001 From: Kyle Kelley Date: Thu, 8 May 2014 13:57:39 -0500 Subject: [PATCH] Clean up style when rejecting/passing on origin --- tornado/websocket.py | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/tornado/websocket.py b/tornado/websocket.py index e9fa3d2e9..6f552f71d 100644 --- a/tornado/websocket.py +++ b/tornado/websocket.py @@ -154,13 +154,11 @@ class WebSocketHandler(tornado.web.RequestHandler): else: origin = self.request.headers.get("Sec-Websocket-Origin", None) - # When origin is None, assume it didn't come from a browser and we can - # pass it on - if origin is None: - pass + # If there was an origin header, check to make sure it matches - # according to check_origin - elif origin and not self.check_origin(origin): + # according to check_origin. When the origin is None, we assume it + # came from a browser and that it can be passed on. + if origin is not None and not self.check_origin(origin): self.stream.write(tornado.escape.utf8( "HTTP/1.1 403 Cross Origin Websockets Disabled\r\n\r\n" )) -- 2.47.2