Description of problem: "corsAllowedOrigins" parameter in a "master-config.yaml" configuration file behavior is either not documented well or leads to a possible security leak. It is possible to set it to "something" and both "something" and "something.hostile.com" in an "Origin:" HTTP header will be matched as valid. It is also possible to set it to "127.0.0.1" and "127a0b0c1" will be matched as valid. Version-Release number of selected component (if applicable): - not applicable How reproducible: - see description above Steps to Reproduce: - see description above Actual results: - see description above Expected results: - see description above Additional info: https://github.com/openshift/origin/blob/master/vendor/github.com/emicklei/go-restful/cors_filter.go#L195 https://github.com/openshift/origin/blob/master/vendor/github.com/emicklei/go-restful/cors_filter.go#L145 https://github.com/kubernetes/apiserver/blob/master/pkg/server/filters/cors.go#L91 https://github.com/kubernetes/apiserver/blob/master/pkg/server/filters/cors.go#L46 https://golang.org/pkg/regexp/#Compile
Correct. It is a regular expression, fully under the control of the config field (i.e. no pinning or escaping is done to the value) We can update documentation to make that clearer
I've added a PR to `openshift-ansible` repo about that: https://github.com/openshift/openshift-ansible/pull/5264
added comment in issue
LGTM.
Content is now published: https://access.redhat.com/documentation/en-us/openshift_container_platform/3.9/html/architecture/infrastructure-components#architecture-infrastructure-components-web-console