Remove Origin and Referer headers while proxying requests

Fix #13949 Fix #13328 Signed-off-by: Julien Pivotto <roidelapluie@inuits.eu> (cherry picked from commit 62417ca69f)
2018-11-08 12:30:10 +01:00
parent 7a8e246349
commit a23780ddf0
2 changed files with 30 additions and 0 deletions
@@ -195,6 +195,10 @@ func (proxy *DataSourceProxy) getDirector() func(req *http.Request) {
 		req.Header.Del("X-Forwarded-Proto")
 		req.Header.Set("User-Agent", fmt.Sprintf("Grafana/%s", setting.BuildVersion))

+		// Clear Origin and Referer to avoir CORS issues
+		req.Header.Del("Origin")
+		req.Header.Del("Referer")
+
 		// set X-Forwarded-For header
 		if req.RemoteAddr != "" {
 			remoteAddr, _, err := net.SplitHostPort(req.RemoteAddr)