Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow array of conditions as options.origin #50

Closed
wants to merge 5 commits into from
Closed

Allow array of conditions as options.origin #50

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e000fd0
Allow regexp as options.origin
alex94cp May 26, 2015
87f91d9
Use RegExp#test vs String#match
alex94cp May 27, 2015
8ce16ba
RegExp unit test added and fixed typo
alex94cp May 28, 2015
82a6cdf
Allow array of matching conditions as options.origin
alex94cp May 28, 2015
29d9bcb
Respect two-spaces indentation
alex94cp May 28, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 41 additions & 10 deletions lib/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,23 +12,54 @@
preflightContinue: false
};

function varyHeadersOn(vary, headers) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@alex94puchades I'm a bit confused on what this function is doing. can you walk me through it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@troygoode It appends a vary header with the passed fields as value. It's easier when used like this:

varyHeadersOn('Origin', headers); // intended to read as varyHeadersOnOrigin(headers)

Its only use is not having to repeat all the key-value vary header boilerplate.

vary = Array.isArray(vary) ? vary : [vary];
headers = Array.isArray(headers) ? headers.slice(0) : [headers];
for (var i = 0; i < vary.length; ++i)
headers.push({ key: 'Vary', value: vary[i] });
return headers;
}

function isString(what) {
return typeof what === 'string' || what instanceof String;
}

function matchOrigin(origin, check) {
if (Array.isArray(check)) {
for (var i = 0; i < check.length; ++i) {
if (matchOrigin(origin, check[i]))
return true;
}
return false;
} else if (isString(check)) {
return origin === check;
} else if (check instanceof RegExp) {
return check.test(origin);
} else {
return !!check;
}
}

function configureOrigin(options, req) {
var origin = req.headers.origin;
if (!options.origin || options.origin === '*') {
// allow any origin
return {
key: 'Access-Control-Allow-Origin',
value: '*'
};
} else if (isString(options.origin)) {
// fixed origin
return varyHeadersOn('Origin', {
key: 'Access-Control-Allow-Origin',
value: options.origin
});
} else {
return [
{
key: 'Access-Control-Allow-Origin',
value: options.origin === true ? req.headers.origin : options.origin
},
{
key: 'Vary',
value: 'Origin'
}
];
// reflect origin
return varyHeadersOn('Origin', {
key: 'Access-Control-Allow-Origin',
value: matchOrigin(origin, options.origin) ? origin : false
});
}
}

Expand Down
26 changes: 25 additions & 1 deletion test/cors.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@
cors()(req, res, next);
});

it('don\'t shortcircuits preflight requests with preflightContinue option', function (done) {
it('doesn\'t shortcircuit preflight requests with preflightContinue option', function (done) {
// arrange
var req, res, next;
req = fakeRequest();
Expand Down Expand Up @@ -186,6 +186,30 @@
cors(options)(req, res, next);
});

it('matches request origin against regexp', function(done) {
var req = fakeRequest();
var res = fakeResponse();
var options = { origin: /^(.+\.)?request.com$/ };
cors(options)(req, res, function(err) {
should.not.exist(err);
res.getHeader('Access-Control-Allow-Origin').should.equal(req.headers.origin);
res.getHeader('Vary').should.equal('Origin');
return done();
});
});

it('matches request origin against array of origin checks', function(done) {
var req = fakeRequest();
var res = fakeResponse();
var options = { origin: [ /foo\.com$/, 'request.com' ] };
cors(options)(req, res, function(err) {
should.not.exist(err);
res.getHeader('Access-Control-Allow-Origin').should.equal(req.headers.origin);
res.getHeader('Vary').should.equal('Origin');
return done();
});
});

it('origin of false disables cors', function (done) {
// arrange
var req, res, next, options;
Expand Down