/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.apache.zeppelin.socket;

import org.eclipse.jetty.websocket.servlet.ServletUpgradeRequest;
import org.eclipse.jetty.websocket.servlet.ServletUpgradeResponse;
import org.eclipse.jetty.websocket.servlet.WebSocketCreator;

/**
 * Responsible to create the WebSockets for the NotebookServer.
 */
public class NotebookWebSocketCreator implements WebSocketCreator {
  private NotebookServer notebookServer;

  public NotebookWebSocketCreator(NotebookServer notebookServer) {
    this.notebookServer = notebookServer;
  }
  public Object createWebSocket(ServletUpgradeRequest request, ServletUpgradeResponse response) {
    return new NotebookSocket(request.getHttpServletRequest(), "", notebookServer);
  }

}

@@ -1024,16 +1024,170 @@
 Creator;
+%0Aimport org.slf4j.Logger;%0Aimport org.slf4j.LoggerFactory;%0A%0Aimport static org.apache.zeppelin.conf.ZeppelinConfiguration.ConfVars.ZEPPELIN_ALLOWED_ORIGINS;
 %0A%0A/**%0A *
@@ -1319,16 +1319,110 @@
 reator %7B
+%0A%0A  private static final Logger LOG = LoggerFactory.getLogger(NotebookWebSocketCreator.class);
 %0A  priva
@@ -1675,87 +1675,379 @@
     
-return new NotebookSocket(request.getHttpServletRequest(), %22%22, notebookServer);
+String origin = request.getHeader(%22Origin%22);%0A    if (notebookServer.checkOrigin(request.getHttpServletRequest(), origin)) %7B%0A      return new NotebookSocket(request.getHttpServletRequest(), %22%22, notebookServer);%0A    %7D else %7B%0A      LOG.error(%22Websocket request is not allowed by %7B%7D settings. Origin: %7B%7D%22,%0A          ZEPPELIN_ALLOWED_ORIGINS, origin);%0A      return null;%0A    %7D
 %0A  %7D

Fix Cross-Site WebSocket check