+htp #20535 add checkSameOrigin directive to HeaderDirectives (#20560)

*  #20535 add checkSameOrigin directive to WebSocketDirectives

* refactoring + add docs

* refactoring + cleanup in docs

* fix types and conversions in the InvalidOriginHeaderRejection

* simplify InvalidOriginHeaderRejection to InvalidOriginRejection

akka-docs/rst/scala/code/docs/http/scaladsl/server/directives/HeaderDirectivesExamplesSpec.scala

@@ -4,13 +4,11 @@
 
 package docs.http.scaladsl.server.directives
 
+import akka.http.scaladsl.model.StatusCodes._
 import akka.http.scaladsl.model._
-import akka.http.scaladsl.server.MissingHeaderRejection
-import akka.http.scaladsl.server.Route
-import akka.http.scaladsl.server.util.ClassMagnet
+import akka.http.scaladsl.model.headers._
+import akka.http.scaladsl.server.{ InvalidOriginRejection, MissingHeaderRejection, Route }
 import docs.http.scaladsl.server.RoutingSpec
-import headers._
-import StatusCodes._
 import org.scalatest.Inside
 
 class HeaderDirectivesExamplesSpec extends RoutingSpec with Inside {
@@ -186,4 +184,38 @@ class HeaderDirectivesExamplesSpec extends RoutingSpec with Inside {
       responseAs[String] shouldEqual "No Origin header found."
     }
   }
+  "checkSameOrigin-0" in {
+    val correctOrigin = HttpOrigin("http://localhost:8080")
+    val route = checkSameOrigin(HttpOriginRange(correctOrigin)) {
+      complete("Result")
+    }
+
+    // tests:
+    // handle request with correct origin headers
+    Get("abc") ~> Origin(correctOrigin) ~> route ~> check {
+      status shouldEqual StatusCodes.OK
+      responseAs[String] shouldEqual "Result"
+    }
+
+    // reject request with missed origin header
+    Get("abc") ~> route ~> check {
+      inside(rejection) {
+        case MissingHeaderRejection(headerName) ⇒ headerName shouldEqual Origin.name
+      }
+    }
+
+    // rejects request with invalid origin headers
+    val invalidHttpOrigin = HttpOrigin("http://invalid.com")
+    val invalidOriginHeader = Origin(invalidHttpOrigin)
+    Get("abc") ~> invalidOriginHeader ~> route ~> check {
+      inside(rejection) {
+        case InvalidOriginRejection(invalidOrigins) ⇒
+          invalidOrigins shouldEqual Seq(invalidHttpOrigin)
+      }
+    }
+    Get("abc") ~> invalidOriginHeader ~> Route.seal(route) ~> check {
+      status shouldEqual StatusCodes.Forbidden
+      responseAs[String] should include(s"${invalidHttpOrigin.value}")
+    }
+  }
 }

akka-docs/rst/scala/http/routing-dsl/directives/alphabetically.rst

@@ -29,6 +29,7 @@ Directive                                   Description
                                             given one to the rejections potentially coming back from the inner route.
 :ref:`-cancelRejections-`                   Adds a ``TransformationRejection`` cancelling all matching rejections
                                             to the rejections potentially coming back from the inner route
+:ref:`-checkSameOrigin-`                    Checks that the request comes from the same origin
 :ref:`-complete-`                           Completes the request using the given arguments
 :ref:`-completeOrRecoverWith-`              "Unwraps" a ``Future[T]`` and runs the inner route when the future has
                                             failed with the error as an extraction of type ``Throwable``

akka-docs/rst/scala/http/routing-dsl/directives/header-directives/checkSameOrigin.rst

@@ -0,0 +1,23 @@
+.. _-checkSameOrigin-:
+
+checkSameOrigin
+===============
+
+Signature
+---------
+
+.. includecode2:: /../../akka-http/src/main/scala/akka/http/scaladsl/server/directives/HeaderDirectives.scala
+   :snippet: checkSameOrigin
+
+Description
+-----------
+Checks that request comes from the same origin. Extracts the ``Origin`` header value and verifies that allowed range
+contains the obtained value. In the case of absent of the ``Origin`` header rejects with a ``MissingHeaderRejection``.
+If the origin value is not in the allowed range rejects with an ``InvalidOriginHeaderRejection``
+and ``StatusCodes.Forbidden`` status.
+
+Example
+-------
+
+.. includecode2:: ../../../../code/docs/http/scaladsl/server/directives/HeaderDirectivesExamplesSpec.scala
+   :snippet: checkSameOrigin-0

akka-docs/rst/scala/http/routing-dsl/directives/header-directives/index.rst

@@ -17,3 +17,4 @@ response headers use one of the :ref:`RespondWithDirectives`.
    optionalHeaderValueByName
    optionalHeaderValueByType
    optionalHeaderValuePF
+   checkSameOrigin