<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
I noticed in Kilo there’s a validation check in the console web socket proxies to ensure the hostnames from the Origin and Host headers match. This was as a result of CVE-2015-0259 (<a href="https://bugs.launchpad.net/nova/+bug/1409142">https://bugs.launchpad.net/nova/+bug/1409142</a>).
Effectively it disabled cross-site web socket connections.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
This is OK for Horizon, but we also run our own custom UI that’s on a different hostname from the console proxy servers. Therefore we need to have the cross-site connections work. I have opened <a href="https://bugs.launchpad.net/nova/+bug/1474079">https://bugs.launchpad.net/nova/+bug/1474079</a> for
this.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
My thought is to add a new nova configuration parameter which would list additional allowed Origin hosts for the proxy servers. And add those to the check at <a href="https://github.com/openstack/nova/blob/master/nova/console/websocketproxy.py#L116">https://github.com/openstack/nova/blob/master/nova/console/websocketproxy.py#L116</a></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<br>
</div>
<div><font face="Calibri,sans-serif">I</font><font face="Calibri,sans-serif"> will probably go ahead and implement that for us internally, but interested in opinions on this approach for upstream Nova purposes. I’m happy to do the work, but want to make sure
this is generally in line with what the community would accept first.</font></div>
<div><font face="Calibri,sans-serif"><br>
</font></div>
<div><font face="Calibri,sans-serif">Thanks,</font></div>
<div><font face="Calibri,sans-serif">Mike</font></div>
<div><font face="Calibri,sans-serif"><br>
</font></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<div id="MAC_OUTLOOK_SIGNATURE"></div>
</div>
</body>
</html>