feat!: Major upgrade django-cors-headers to new version 3.2.0

BREAKING CHANGES:
- `CORS_ORIGIN_WHITELIST` now requires URI schemes.
- Added new list `CORS_ORIGIN_WHITELIST_WITH_SCHEME` which contains all links of `CORS_ORIGIN_WHITELIST` with schemes and load the desired list after checking installed version.
- For more details, visit this: https://github.com/adamchainz/django-cors-headers/blob/main/HISTORY.rst#320-2019-11-15

openedx/core/djangoapps/cors_csrf/helpers.py

@@ -48,9 +48,14 @@ def is_cross_domain_request_allowed(request):
             log.debug("Referer '%s' must have the scheme 'https'")
             return False
 
+    scheme_with_host = referer
+    # if url is like `https://www.foo.bar/baz/` following check will return `https://www.foo.bar`
+    if referer and referer_parts.scheme and referer_parts.path:
+        scheme_with_host = referer.replace(referer_parts.path, '')
+
     domain_is_whitelisted = (
         getattr(settings, 'CORS_ORIGIN_ALLOW_ALL', False) or
-        referer_hostname in getattr(settings, 'CORS_ORIGIN_WHITELIST', [])
+        scheme_with_host in getattr(settings, 'CORS_ORIGIN_WHITELIST', [])
     )
     if not domain_is_whitelisted:
         if referer_hostname is None:

openedx/core/djangoapps/cors_csrf/tests/test_authentication.py

@@ -40,7 +40,7 @@ class CrossDomainAuthTest(TestCase):
         'ENABLE_CROSS_DOMAIN_CSRF_COOKIE': True
     })
     @override_settings(
-        CORS_ORIGIN_WHITELIST=["www.edx.org"],
+        CORS_ORIGIN_WHITELIST=["https://www.edx.org"],
         CROSS_DOMAIN_CSRF_COOKIE_NAME="prod-edx-csrftoken",
         CROSS_DOMAIN_CSRF_COOKIE_DOMAIN=".edx.org"
     )

openedx/core/djangoapps/cors_csrf/tests/test_middleware.py

@@ -18,6 +18,7 @@ from ..middleware import CorsCSRFMiddleware, CsrfCrossDomainCookieMiddleware
 SENTINEL = object()
 
 
+@ddt.ddt
 class TestCorsMiddlewareProcessRequest(TestCase):
     """
     Test processing a request through the middleware
@@ -64,35 +65,41 @@ class TestCorsMiddlewareProcessRequest(TestCase):
         assert res is SENTINEL
         assert request.is_secure()
 
-    @override_settings(CORS_ORIGIN_WHITELIST=['foo.com'])
-    def test_enabled(self):
-        request = self.get_request(is_secure=True, http_referer='https://foo.com/bar')
+    @override_settings(CORS_ORIGIN_WHITELIST=[
+        'https://foo.com', 'https://www.foo.com', 'https://learning.edge.foo.bar']
+    )
+    @ddt.data(
+        'https://foo.com/bar/', 'https://foo.com/bar/baz/', 'https://www.foo.com/bar/baz/',
+        'https://learning.edge.foo.bar', 'https://learning.edge.foo.bar/foo'
+    )
+    def test_enabled(self, http_referer):
+        request = self.get_request(is_secure=True, http_referer=http_referer)
         self.check_enabled(request)
 
     @override_settings(
         FEATURES={'ENABLE_CORS_HEADERS': False},
-        CORS_ORIGIN_WHITELIST=['foo.com']
+        CORS_ORIGIN_WHITELIST=['https://foo.com']
     )
     def test_disabled_no_cors_headers(self):
         with pytest.raises(MiddlewareNotUsed):
             CorsCSRFMiddleware()
 
-    @override_settings(CORS_ORIGIN_WHITELIST=['bar.com'])
+    @override_settings(CORS_ORIGIN_WHITELIST=['https://bar.com'])
     def test_disabled_wrong_cors_domain(self):
         request = self.get_request(is_secure=True, http_referer='https://foo.com/bar')
         self.check_not_enabled(request)
 
-    @override_settings(CORS_ORIGIN_WHITELIST=['foo.com'])
+    @override_settings(CORS_ORIGIN_WHITELIST=['https://foo.com'])
     def test_disabled_wrong_cors_domain_reversed(self):
         request = self.get_request(is_secure=True, http_referer='https://bar.com/bar')
         self.check_not_enabled(request)
 
-    @override_settings(CORS_ORIGIN_WHITELIST=['foo.com'])
+    @override_settings(CORS_ORIGIN_WHITELIST=['https://foo.com'])
     def test_disabled_http_request(self):
         request = self.get_request(is_secure=False, http_referer='https://foo.com/bar')
         self.check_not_enabled(request)
 
-    @override_settings(CORS_ORIGIN_WHITELIST=['foo.com'])
+    @override_settings(CORS_ORIGIN_WHITELIST=['https://foo.com'])
     def test_disabled_http_referer(self):
         request = self.get_request(is_secure=True, http_referer='http://foo.com/bar')
         self.check_not_enabled(request)
@@ -220,7 +227,7 @@ class TestCsrfCrossDomainCookieMiddleware(TestCase):
     @override_settings(
         CROSS_DOMAIN_CSRF_COOKIE_NAME=COOKIE_NAME,
         CROSS_DOMAIN_CSRF_COOKIE_DOMAIN=COOKIE_DOMAIN,
-        CORS_ORIGIN_WHITELIST=['www.example.com']
+        CORS_ORIGIN_WHITELIST=['https://www.example.com']
     )
     def test_set_cross_domain_cookie(self):
         response = self._get_response()

openedx/core/djangoapps/enrollments/tests/test_views.py

@@ -1260,7 +1260,7 @@ def cross_domain_config(func):
         'ENABLE_CROSS_DOMAIN_CSRF_COOKIE': True
     })
     settings_decorator = override_settings(
-        CORS_ORIGIN_WHITELIST=["www.edx.org"],
+        CORS_ORIGIN_WHITELIST=["https://www.edx.org"],
         CROSS_DOMAIN_CSRF_COOKIE_NAME="prod-edx-csrftoken",
         CROSS_DOMAIN_CSRF_COOKIE_DOMAIN=".edx.org"
     )