@bardioc/app-sdk 0.4.7 → 0.4.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/dev-proxy.js +13 -2
- package/package.json +1 -1
package/dist/dev-proxy.js
CHANGED
|
@@ -31,6 +31,16 @@ function addDevSecretHeader(req, headers, devSecret) {
|
|
|
31
31
|
}
|
|
32
32
|
return headers;
|
|
33
33
|
}
|
|
34
|
+
// The BFF answers a bare 403 for any Origin outside its CORS allow-list, which no
|
|
35
|
+
// localhost dev server is in. Dropping Origin makes it a non-CORS request, and the
|
|
36
|
+
// dev-secret check then still passes via its Referer localhost fallback.
|
|
37
|
+
function dropOriginKeepReferer(headers) {
|
|
38
|
+
const origin = headers.get('Origin');
|
|
39
|
+
if (origin && !headers.has('Referer')) {
|
|
40
|
+
headers.set('Referer', `${origin}/`);
|
|
41
|
+
}
|
|
42
|
+
headers.delete('Origin');
|
|
43
|
+
}
|
|
34
44
|
export function createDevAuthProxyHandler(options) {
|
|
35
45
|
const apiBaseUrl = normalizeApiBaseUrl(options.apiBaseUrl);
|
|
36
46
|
const { devSecret, allowOrigin } = options;
|
|
@@ -49,8 +59,8 @@ export function createDevAuthProxyHandler(options) {
|
|
|
49
59
|
const upstreamPath = url.pathname.slice('/rest'.length) + url.search;
|
|
50
60
|
const upstreamUrl = `${apiBaseUrl}${upstreamPath}`;
|
|
51
61
|
const headers = new Headers();
|
|
52
|
-
// Forward headers from the browser so the BFF sees the same request the host would
|
|
53
|
-
// (cookies,
|
|
62
|
+
// Forward headers from the browser so the BFF sees the same request the host would
|
|
63
|
+
// relay (cookies, referer, etc.). Skip hop-by-hop headers; fetch sets Host from the URL.
|
|
54
64
|
const skipHeaders = new Set([
|
|
55
65
|
'connection',
|
|
56
66
|
'content-length',
|
|
@@ -74,6 +84,7 @@ export function createDevAuthProxyHandler(options) {
|
|
|
74
84
|
}
|
|
75
85
|
}
|
|
76
86
|
addDevSecretHeader(req, headers, devSecret);
|
|
87
|
+
dropOriginKeepReferer(headers);
|
|
77
88
|
// Dev auth is dev-secret only: never forward X-App-Id, so the BFF app-token
|
|
78
89
|
// exchange (which would also demand X-Scope-ID) can never be triggered here.
|
|
79
90
|
headers.delete('X-App-Id');
|