mod_bosh: Only return CORS headers if the Origin header is received, and CORS is enabled.

1 files changed, 4 insertions, 2 deletions

diff --git a/plugins/mod_bosh.lua b/plugins/mod_bosh.lua
index 48d16df1..04d85e60 100644
--- a/plugins/mod_bosh.lua
+++ b/plugins/mod_bosh.lua
@@ -100,7 +100,9 @@ local function set_cross_domain_headers(response)
 end
 
 function handle_OPTIONS(event)
-	set_cross_domain_headers(event.response);
+	if cross_domain and event.request.headers.origin then
+		set_cross_domain_headers(event.response);
+	end
 	return "";
 end
 
@@ -118,7 +120,7 @@ function handle_POST(event)
 	local headers = response.headers;
 	headers.content_type = "text/xml; charset=utf-8";
 
-	if cross_domain then
+	if cross_domain and event.request.headers.origin then
 		set_cross_domain_headers(response);
 	end