优化结构

pkg/websocket/melody.go

@@ -3,7 +3,6 @@ package websocket
 
 import (
 	"net/http"
-	"net/url"
 	"strings"
 	"sync"
 	"time"
@@ -80,12 +79,9 @@ func New(config Config) *Server {
 	allowed := append([]string(nil), c.AllowOrigins...)
 	m.Upgrader.CheckOrigin = func(r *http.Request) bool {
 		if len(allowed) == 0 {
-			origin := r.Header.Get("Origin")
-			if origin == "" {
-				return true
-			}
-			parsed, err := url.Parse(origin)
-			return err == nil && strings.EqualFold(parsed.Host, r.Host)
+			// An empty allowlist means no origin restriction. Deployments that
+			// need a restriction can provide allow_origins explicitly.
+			return true
 		}
 		origin := r.Header.Get("Origin")
 		for _, value := range allowed {

pkg/websocket/melody_test.go

@@ -48,3 +48,15 @@ func TestServerReceivesAndSendsTextMessages(t *testing.T) {
 		t.Fatal("first message handler was overwritten")
 	}
 }
+
+func TestServerAllowsAnyOriginByDefault(t *testing.T) {
+	server := New(Config{})
+	defer server.Close()
+
+	request := httptest.NewRequest(http.MethodGet, "http://127.0.0.1:8000/ws", nil)
+	request.Host = "127.0.0.1:8000"
+	request.Header.Set("Origin", "http://evil.example")
+	if !server.Melody().Upgrader.CheckOrigin(request) {
+		t.Fatal("origin was rejected when allow_origins is empty")
+	}
+}