+htp #20535 add checkSameOrigin directive to HeaderDirectives (#20560)

*  #20535 add checkSameOrigin directive to WebSocketDirectives

* refactoring + add docs

* refactoring + cleanup in docs

* fix types and conversions in the InvalidOriginHeaderRejection

* simplify InvalidOriginHeaderRejection to InvalidOriginRejection

akka-docs/rst/java/code/docs/http/javadsl/server/directives/HeaderDirectivesExamplesTest.java

@@ -13,12 +13,13 @@ import akka.http.javadsl.model.HttpRequest;
 import akka.http.javadsl.model.StatusCodes;
 import akka.http.javadsl.model.headers.Host;
 import akka.http.javadsl.model.headers.HttpOrigin;
+import akka.http.javadsl.model.headers.HttpOriginRange;
 import akka.http.javadsl.model.headers.Origin;
 import akka.http.javadsl.model.headers.RawHeader;
-import akka.http.javadsl.server.Rejections;
 import akka.http.javadsl.server.Route;
 import akka.http.javadsl.testkit.JUnitRouteTest;
 import akka.japi.JavaPartialFunction;
+import akka.http.javadsl.testkit.TestRoute;
 import scala.PartialFunction;
 
 public class HeaderDirectivesExamplesTest extends JUnitRouteTest {
@@ -227,4 +228,34 @@ public class HeaderDirectivesExamplesTest extends JUnitRouteTest {
                     .assertEntity("The port was not provided explicitly");
     //#optionalHeaderValuePF
   }
+
+  @Test
+  public void testCheckSameOrigin() {
+    //#checkSameOrigin
+    final HttpOrigin validOriginHeader =
+            HttpOrigin.create("http://localhost", Host.create("8080"));
+
+    final HttpOriginRange validOriginRange = HttpOriginRange.create(validOriginHeader);
+
+    final TestRoute route = testRoute(
+            checkSameOrigin(validOriginRange,
+                    () -> complete("Result")));
+
+    route
+            .run(HttpRequest.create().addHeader(Origin.create(validOriginHeader)))
+            .assertStatusCode(StatusCodes.OK)
+            .assertEntity("Result");
+
+    route
+            .run(HttpRequest.create())
+            .assertStatusCode(StatusCodes.BAD_REQUEST);
+
+    final HttpOrigin invalidOriginHeader =
+            HttpOrigin.create("http://invalid.com", Host.create("8080"));
+
+    route
+            .run(HttpRequest.create().addHeader(Origin.create(invalidOriginHeader)))
+            .assertStatusCode(StatusCodes.FORBIDDEN);
+    //#checkSameOrigin
+  }
 }

akka-docs/rst/java/http/routing-dsl/directives/alphabetically.rst

@@ -19,6 +19,7 @@ Directive                                        Description
 :ref:`-authorizeAsync-java-`                     Applies the given asynchronous authorization check to the request 
 :ref:`-cancelRejection-java-`                    Adds a ``TransformationRejection`` cancelling all rejections equal to the given one to the rejections potentially coming back from the inner route. 
 :ref:`-cancelRejections-java-`                   Adds a ``TransformationRejection`` cancelling all matching rejections to the rejections potentially coming back from the inner route
+:ref:`-checkSameOrigin-java-`                    Checks that the request comes from the same origin
 :ref:`-complete-java-`                           Completes the request using the given arguments
 :ref:`-completeOrRecoverWith-java-`              "Unwraps" a ``CompletionStage<T>`` and runs the inner route when the future has failed with the error as an extraction of type ``Throwable``
 :ref:`-completeWith-java-`                       Uses the marshaller for a given type to extract a completion function

akka-docs/rst/java/http/routing-dsl/directives/header-directives/checkSameOrigin.rst

@@ -0,0 +1,17 @@
+.. _-checkSameOrigin-java-:
+
+checkSameOrigin
+===============
+
+Description
+-----------
+Checks that request comes from the same origin. Extracts the ``Origin`` header value and verifies that allowed range
+contains the obtained value. In the case of absent of the ``Origin`` header rejects with a ``MissingHeaderRejection``.
+If the origin value is not in the allowed range rejects with an ``InvalidOriginHeaderRejection``
+and ``StatusCodes.FORBIDDEN`` status.
+
+Example
+-------
+Checking the ``Origin`` header:
+
+.. includecode:: ../../../../code/docs/http/javadsl/server/directives/HeaderDirectivesExamplesTest.java#checkSameOrigin

akka-docs/rst/java/http/routing-dsl/directives/header-directives/index.rst

@@ -17,3 +17,4 @@ response headers use one of the :ref:`RespondWithDirectives-java`.
    optionalHeaderValueByName
    optionalHeaderValueByType
    optionalHeaderValuePF
+   checkSameOrigin