fix(security): originVetoer skips only genuine CORS preflights, not all

OPTIONS

Author: ujibang

security/src/main/java/org/restheart/security/authorizers/OriginVetoer.java

@@ -116,6 +116,20 @@ public void init() {
 
     @Override
     public boolean isAllowed(final Request<?> request) {
+        // Allow genuine CORS preflight through — the service handles CORS headers.
+        // A preflight is issued by the browser and carries no credentials, so it
+        // can't be a CSRF vector; the actual request (POST, GET, etc.) is checked
+        // instead. Vetoing it would be pointless anyway: browsers fail a preflight
+        // whose status is not 2xx, no matter which CORS headers it carries.
+        // Plain OPTIONS requests (no Origin, no Access-Control-Request-Method) are
+        // not preflights and stay subject to the check.
+        if (request.isOptions()
+                && request.getHeader("Origin") != null
+                && request.getHeader("Access-Control-Request-Method") != null) {
+            LOGGER.debug("originVetoer: CORS preflight accepted without checking the Origin header");
+            return true;
+        }
+
         if (ignoreLists != null && ignoreLists.match(request.getPath()) != null) {
             LOGGER.debug("originVetoer: request is accepted since path is in ignore list");
             return true;

security/src/test/java/org/restheart/security/authorizers/OriginVetoerTest.java

@@ -74,6 +74,16 @@ private Request<?> requestWith(String origin, List<String> overrideWhitelist, Bo
         return req;
     }
 
+    /** An OPTIONS request; a genuine CORS preflight also carries Access-Control-Request-Method. */
+    private Request<?> optionsRequestWith(String origin, String accessControlRequestMethod) {
+        var req = mock(Request.class);
+        when(req.getPath()).thenReturn("/some/path");
+        when(req.isOptions()).thenReturn(true);
+        when(req.getHeader("Origin")).thenReturn(origin);
+        when(req.getHeader("Access-Control-Request-Method")).thenReturn(accessControlRequestMethod);
+        return req;
+    }
+
     @Test
     void noOverride_usesStaticWhitelist() throws Exception {
         var vetoer = newVetoer(List.of("https://allowed.example.com"));
@@ -160,4 +170,27 @@ void allowMissingOrigin_withOverrideWhitelist() throws Exception {
         // non-whitelisted origin still denied
         assertFalse(vetoer.isAllowed(requestWith("https://other.example.com", List.of("https://tenant.example.com"))));
     }
+
+    @Test
+    void corsPreflight_allowedEvenWithNonWhitelistedOrigin() throws Exception {
+        var vetoer = newVetoer(List.of("https://allowed.example.com"), false);
+
+        // a preflight carries no credentials, so it can't be a CSRF vector: it is
+        // let through so the service can answer with the CORS headers, and the
+        // actual request is vetoed instead
+        assertTrue(vetoer.isAllowed(optionsRequestWith("https://not-allowed.example.com", "POST")));
+    }
+
+    @Test
+    void optionsWithoutPreflightHeaders_isStillChecked() throws Exception {
+        var vetoer = newVetoer(List.of("https://allowed.example.com"), false);
+
+        // OPTIONS without Access-Control-Request-Method is not a preflight
+        assertFalse(vetoer.isAllowed(optionsRequestWith("https://not-allowed.example.com", null)));
+
+        // OPTIONS without Origin is not a preflight either — it never comes from a
+        // browser, so it stays subject to allow-missing-origin
+        assertFalse(vetoer.isAllowed(optionsRequestWith(null, null)));
+        assertFalse(vetoer.isAllowed(optionsRequestWith(null, "POST")));
+    }
 }