Allow same origin CORS requests without 3rd party origins being confi…

…gured

extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/cors/CORSSameOriginWithoutOriginConfigTestCase.java

@@ -0,0 +1,36 @@
+package io.quarkus.vertx.http.cors;
+
+import static io.restassured.RestAssured.given;
+import static org.hamcrest.Matchers.nullValue;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+
+import io.quarkus.test.QuarkusUnitTest;
+
+class CORSSameOriginWithoutOriginConfigTestCase {
+
+    @RegisterExtension
+    static QuarkusUnitTest runner = new QuarkusUnitTest()
+            .withApplicationRoot((jar) -> jar
+                    .addClasses(BeanRegisteringRoute.class)
+                    .addAsResource("conf/cors-same-origin-only.properties", "application.properties"));
+
+    @Test
+    void corsSameOriginRequest() {
+        String origin = "http://localhost:8081";
+        given().header("Origin", origin)
+                .get("/test").then()
+                .statusCode(200)
+                .header("Access-Control-Allow-Origin", origin);
+    }
+
+    @Test
+    void corsInvalidSameOriginRequest() {
+        String origin = "http://externalhost:8081";
+        given().header("Origin", origin)
+                .get("/test").then()
+                .statusCode(403)
+                .header("Access-Control-Allow-Origin", nullValue());
+    }
+}

extensions/vertx-http/deployment/src/test/resources/conf/cors-same-origin-only.properties

@@ -0,0 +1 @@
+quarkus.http.cors=true

extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/cors/CORSFilter.java

@@ -187,10 +187,13 @@ public void handle(RoutingContext event) {
 
             boolean allowsOrigin = wildcardOrigin;
             if (!allowsOrigin) {
-                allowsOrigin = !corsConfig.origins.isEmpty()
-                        && (corsConfig.origins.get().contains(origin)
-                                || isOriginAllowedByRegex(allowedOriginsRegex, origin)
-                                || isSameOrigin(request, origin));
+                if (!corsConfig.origins.isEmpty()) {
+                    allowsOrigin = corsConfig.origins.get().contains(origin)
+                            || isOriginAllowedByRegex(allowedOriginsRegex, origin)
+                            || isSameOrigin(request, origin);
+                } else {
+                    allowsOrigin = isSameOrigin(request, origin);
+                }
             }
 
             if (allowsOrigin) {