Reject request with incorrect transport (Fixes #367)

miguelgrinberg · Oct 15, 2024 · 7ad1448 · 7ad1448
1 parent 91d83c2
commit 7ad1448
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 6 deletions.
diff --git a/src/engineio/async_server.py b/src/engineio/async_server.py
@@ -269,11 +269,11 @@ async def handle_request(self, *args, **kwargs):
                                  'bad-jsonp-index')
             r = self._bad_request('Invalid JSONP index number')
         elif method == 'GET':
+            upgrade_header = environ.get('HTTP_UPGRADE').lower() \
+                if 'HTTP_UPGRADE' in environ else None
             if sid is None:
                 # transport must be one of 'polling' or 'websocket'.
                 # if 'websocket', the HTTP_UPGRADE header must match.
-                upgrade_header = environ.get('HTTP_UPGRADE').lower() \
-                    if 'HTTP_UPGRADE' in environ else None
                 if transport == 'polling' \
                         or transport == upgrade_header == 'websocket':
                     r = await self._handle_connect(environ, transport,
@@ -288,7 +288,8 @@ async def handle_request(self, *args, **kwargs):
                     r = self._bad_request('Invalid session ' + sid)
                 else:
                     socket = self._get_socket(sid)
-                    if self.transport(sid) != transport:
+                    if self.transport(sid) != transport and \
+                            transport != upgrade_header:
                         self._log_error_once(
                             'Invalid transport for session ' + sid,
                             'bad-transport')

diff --git a/src/engineio/server.py b/src/engineio/server.py
@@ -251,11 +251,11 @@ def handle_request(self, environ, start_response):
                                  'bad-jsonp-index')
             r = self._bad_request('Invalid JSONP index number')
         elif method == 'GET':
+            upgrade_header = environ.get('HTTP_UPGRADE').lower() \
+                if 'HTTP_UPGRADE' in environ else None
             if sid is None:
                 # transport must be one of 'polling' or 'websocket'.
                 # if 'websocket', the HTTP_UPGRADE header must match.
-                upgrade_header = environ.get('HTTP_UPGRADE').lower() \
-                    if 'HTTP_UPGRADE' in environ else None
                 if transport == 'polling' \
                         or transport == upgrade_header == 'websocket':
                     r = self._handle_connect(environ, start_response,
@@ -270,7 +270,8 @@ def handle_request(self, environ, start_response):
                     r = self._bad_request('Invalid session')
                 else:
                     socket = self._get_socket(sid)
-                    if self.transport(sid) != transport:
+                    if self.transport(sid) != transport and \
+                            transport != upgrade_header:
                         self._log_error_once(
                             'Invalid transport for session ' + sid,
                             'bad-transport')