Repository: streamlit/streamlit
File: lib/streamlit/web/server/routes.py (Python)

Code before:
    "https://*.streamlitapp.test",
    "https://*.streamlitapp.com",
    "https://*.streamlit.run",
    "https://*.demo.streamlit.app",
    "https://*.head.streamlit.app",
    "https://*.staging.streamlit.app",
    "https://*.streamlit.app",
]


class AllowedMessageOriginsHandler(_SpecialRequestHandler):
    async def get(self) -> None:
        # ALLOWED_MESSAGE_ORIGINS must be wrapped in a dictionary because Tornado
        # disallows writing lists directly into responses due to potential XSS
        # vulnerabilities.
        # See https://www.tornadoweb.org/en/stable/web.html#tornado.web.RequestHandler.write
        self.write({"allowedOrigins": ALLOWED_MESSAGE_ORIGINS})
        self.set_status(200)

        if config.get_option("server.enableXsrfProtection"):
            self.set_cookie("_xsrf", self.xsrf_token)


class MessageCacheHandler(tornado.web.RequestHandler):
    """Returns ForwardMsgs from our MessageCache"""

    def initialize(self, cache):
        """Initializes the handler.

        Parameters
        ----------
        cache : MessageCache

        """
        self._cache = cache

    def set_default_headers(self):
        if allow_cross_origin_requests():
            self.set_header("Access-Control-Allow-Origin", "*")

    def get(self):
        msg_hash = self.get_argument("hash", None)
        if msg_hash is None:
            # Hash is missing! This is a malformed request.
            _LOGGER.error(
                "HTTP request for cached message is missing the hash attribute."
            )
            self.set_status(404)
            raise tornado.web.Finish()

        message = self._cache.get_message(msg_hash)

Review comment (refactor):
nit: I think it should be okay to remove this and allow the `/_stcore/health` endpoint be reponsible for setting the browser tab's xsrf

Code after:
    "https://*.streamlitapp.test",
    "https://*.streamlitapp.com",
    "https://*.streamlit.run",
    "https://*.demo.streamlit.app",
    "https://*.head.streamlit.app",
    "https://*.staging.streamlit.app",
    "https://*.streamlit.app",
]


class AllowedMessageOriginsHandler(_SpecialRequestHandler):
    async def get(self) -> None:
        # ALLOWED_MESSAGE_ORIGINS must be wrapped in a dictionary because Tornado
        # disallows writing lists directly into responses due to potential XSS
        # vulnerabilities.
        # See https://www.tornadoweb.org/en/stable/web.html#tornado.web.RequestHandler.write
        self.write(
            {
                "allowedOrigins": ALLOWED_MESSAGE_ORIGINS,
                "useExternalAuthToken": False,
            }
        )
        self.set_status(200)


class MessageCacheHandler(tornado.web.RequestHandler):
    """Returns ForwardMsgs from our MessageCache"""

    def initialize(self, cache):
        """Initializes the handler.

        Parameters
        ----------
        cache : MessageCache

        """
        self._cache = cache

    def set_default_headers(self):
        if allow_cross_origin_requests():
            self.set_header("Access-Control-Allow-Origin", "*")

    def get(self):
        msg_hash = self.get_argument("hash", None)
        if msg_hash is None:
            # Hash is missing! This is a malformed request.
            _LOGGER.error(
                "HTTP request for cached message is missing the hash attribute."
            )
            self.set_status(404)
            raise tornado.web.Finish()