CORS preflight OPTIONS requests should bypass authentication about pomerium

[nitper]

Your second link as well as the spec I posted originally are the best resources I have seen. There are various blog posts out there but they all seem to reference these two links.

There's also this page https://enable-cors.org/server.html which links to this handy server flowchart. Since Pomerium is a proxy, I believe it should verify that an OPTIONS request has all the necessary headers to qualify it as preflight, and then forward that to the server without authentication.

I'll need to double-check this, but it seems the preflight OPTIONS request must include these headers:

• Access-Control-Request-Method
• Access-Control-Request-Headers

---

For what it's worth, my downstream server is using Echo as the server with the CORS middleware.

My frontend is using axios setting withCredentials: true

  // `withCredentials` indicates whether or not cross-site Access-Control requests
  // should be made using credentials
  withCredentials: false, // default

Pomerium is working just fine with this setup for CORS simple requests

[nitper]

I did some searching around, and there are a bunch of other proxy projects that have implemented this. Here's one example https://github.com/istio/proxy/issues/651

[desimone]

Hi @nitper thank you bug report.

I didn't know that about OPTIONS. We should conform to the spec, but I would like to better understand the use-case and investigate a bit regarding any potential security implications of having a bypass.

Could you point me in the direction right direction to read more about OPTIONS?

Ref for later self:

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/OPTIONS
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

[nitper]

@desimone I'd be happy to submit a PR.

I was thinking about adding a field cors_allow_preflight (not married to the name) to Policy with a default of false. This way the user can manually and intentionally enable the unauthenticated passthrough of OPTIONS requests for each route as needed.

What do you think?

[desimone]

@nitper Thank you, a PR would be greatly appreciated!

I think the field name of cors_allow_preflight makes sense, and agree that defaulting to "off" is a safe choice.

More reading for future travelers:

• https://security.stackexchange.com/questions/21413/how-to-exploit-http-methods
• https://www.owasp.org/index.php/Test_HTTP_Methods_(OTG-CONFIG-006)#Arbitrary_HTTP_Methods
• https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html