parameters: (self)
return_statement: return allow
docstring: Check Referer for cross-site requests.
  
          Disables requests to certain endpoints with
          external or missing Referer.
  
          If set, allow_origin settings are applied to the Referer
          to whitelist specific cross-origin sites.
  
          Used on GET for api endpoints and /files/
          to block cross-site inclusion (XSSI).
docstring_summary: Check Referer for cross-site requests.
docstring_tokens: Check Referer for cross - site requests .
function: def check_referer(self):
          """Check Referer for cross-site requests.
  
          Disables requests to certain endpoints with
          external or missing Referer.
  
          If set, allow_origin settings are applied to the Referer
          to whitelist specific cross-origin sites.
  
          Used on GET for api endpoints and /files/
          to block cross-site inclusion (XSSI).
          """
  
          if self.allow_origin == "*" or self.skip_check_origin():
              return True
  
          host = self.request.headers.get("Host")
          referer = self.request.headers.get("Referer")
  
          if not host:
              self.log.warning("Blocking request with no host")
              return False
          if not referer:
              self.log.warning("Blocking request with no referer")
              return False
  
          referer_url = urlparse(referer)
          referer_host = referer_url.netloc
          if referer_host == host:
              return True
  
          # apply cross-origin checks to Referer:
          origin = "{}://{}".format(referer_url.scheme, referer_url.netloc)
          if self.allow_origin:
              allow = self.allow_origin == origin
          elif self.allow_origin_pat:
              allow = bool(self.allow_origin_pat.match(origin))
          else:
              # No CORS settings, deny the request
              allow = False
  
          if not allow:
              self.log.warning("Blocking Cross Origin request for %s.  Referer: %s, Host: %s",
                  self.request.path, origin, host,
              )
          return allow
function_tokens: def check_referer ( self ) : if self . allow_origin == "*" or self . skip_check_origin ( ) : return True host = self . request . headers . get ( "Host" ) referer = self . request . headers . get ( "Referer" ) if not host : self . log . warning ( "Blocking request with no host" ) return False if not referer : self . log . warning ( "Blocking request with no referer" ) return False referer_url = urlparse ( referer ) referer_host = referer_url . netloc if referer_host == host : return True # apply cross-origin checks to Referer: origin = "{}://{}" . format ( referer_url . scheme , referer_url . netloc ) if self . allow_origin : allow = self . allow_origin == origin elif self . allow_origin_pat : allow = bool ( self . allow_origin_pat . match ( origin ) ) else : # No CORS settings, deny the request allow = False if not allow : self . log . warning ( "Blocking Cross Origin request for %s.  Referer: %s, Host: %s" , self . request . path , origin , host , ) return allow