fix(site apps): Allow site-apps to be served across Origin (#25910)

This PR allows the /site_app/ endpoint to be called from a different HTTP ORIGIN
PostHog · Oct 30, 2024 · adf806f · adf806f
1 parent bc07ba4
commit adf806f
Show file tree

Hide file tree

Showing 2 changed files with 37 additions and 1 deletion.
diff --git a/posthog/api/test/test_site_app.py b/posthog/api/test/test_site_app.py
@@ -41,6 +41,42 @@ def test_site_app(self):
             f"function inject(){{}}().inject({{config:{{}},posthog:window['__$$ph_site_app_{plugin_config.id}']}})",
         )
 
+    def test_cors_access(self):
+        plugin = Plugin.objects.create(organization=self.team.organization, name="My Plugin", plugin_type="source")
+        PluginSourceFile.objects.create(
+            plugin=plugin,
+            filename="site.ts",
+            source="export function inject (){}",
+            transpiled="function inject(){}",
+            status=PluginSourceFile.Status.TRANSPILED,
+        )
+        plugin_config = PluginConfig.objects.create(
+            plugin=plugin,
+            enabled=True,
+            order=1,
+            team=self.team,
+            config={},
+            web_token="tokentoken",
+        )
+
+        unauthenticated_client = Client(enforce_csrf_checks=True)
+        unauthenticated_client.logout()
+        request_headers = {"HTTP_ACCESS_CONTROL_REQUEST_METHOD": "GET", "HTTP_ORIGIN": "*", "USER_AGENT": "Agent 008"}
+        response = unauthenticated_client.get(
+            f"/site_app/{plugin_config.id}/tokentoken/somehash/",
+            data={},
+            follow=False,
+            secure=False,
+            headers={},
+            **request_headers,
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(
+            response.content.decode("utf-8"),
+            f"function inject(){{}}().inject({{config:{{}},posthog:window['__$$ph_site_app_{plugin_config.id}']}})",
+        )
+
     def test_get_site_config_from_schema(self):
         schema: list[dict] = [{"key": "in_site", "site": True}, {"key": "not_in_site"}]
         config = {"in_site": "123", "not_in_site": "12345"}

diff --git a/posthog/settings/web.py b/posthog/settings/web.py
@@ -255,7 +255,7 @@
 LOGOUT_URL = "/logout"
 LOGIN_REDIRECT_URL = "/"
 APPEND_SLASH = False
-CORS_URLS_REGEX = r"^/api/(?!early_access_features|surveys|web_experiments).*$"
+CORS_URLS_REGEX = r"^(/site_app/|/api/(?!early_access_features|surveys|web_experiments).*$)"
 CORS_ALLOW_HEADERS = default_headers + CORS_ALLOWED_TRACING_HEADERS
 X_FRAME_OPTIONS = "SAMEORIGIN"