@browserless.io/browserless 2.33.0 → 2.34.0-beta-0

package/src/server.ts

@@ -19,6 +19,7 @@ import {
   contentTypes,
   convertPathToURL,
   isMatch,
+  moveTokenToHeader,
   queryParamsToObject,
   readBody,
   shimLegacyRequests,
@@ -131,8 +132,9 @@ export class HTTPServer extends EventEmitter {
     request: http.IncomingMessage,
     res: http.ServerResponse,
   ) {
+    request.url = moveTokenToHeader(request);
     this.logger.trace(
-      `Handling inbound HTTP request on "${request.method}: ${request.url}"`,
+      `Handling inbound HTTP request on "${request.method}: ${request.url || ''}"`,
     );
 
     const req = request as Request;
@@ -193,8 +195,12 @@ export class HTTPServer extends EventEmitter {
 
     this.logger.trace(`Found matching HTTP route handler "${route.path}"`);
 
+    if (route.before && !(await route.before(req, res))) {
+      return;
+    }
+
     if (route?.auth) {
-      this.logger.trace(`Authorizing HTTP request to "${request.url}"`);
+      this.logger.trace(`Authorizing HTTP request to "${request.url || ''}"`);
       const isPermitted = await this.token.isAuthorized(req, route);
 
       if (!isPermitted) {
@@ -320,7 +326,11 @@ export class HTTPServer extends EventEmitter {
     socket: stream.Duplex,
     head: Buffer,
   ) {
-    this.logger.trace(`Handling inbound WebSocket request on "${request.url}"`);
+    request.url = moveTokenToHeader(request);
+
+    this.logger.trace(
+      `Handling inbound WebSocket request on "${request.url || ''}"`,
+    );
 
     const req = request as Request;
     const proceed = await this.hooks.before({ head, req, socket });
@@ -338,6 +348,10 @@ export class HTTPServer extends EventEmitter {
         `Found matching WebSocket route handler "${route.path}"`,
       );
 
+      if (route.before && !(await route.before(req, socket, head))) {
+        return;
+      }
+
       if (route?.auth) {
         this.logger.trace(
           `Authorizing WebSocket request to "${req.parsed.href}"`,

package/src/shim.spec.ts

@@ -1,5 +1,9 @@
+import * as http from 'http';
 import { expect } from 'chai';
-import { shimLegacyRequests } from '@browserless.io/browserless';
+import {
+  shimLegacyRequests,
+  moveTokenToHeader,
+} from '@browserless.io/browserless';
 
 describe('Request Shimming', () => {
   describe('headless', () => {
@@ -169,4 +173,39 @@ describe('Request Shimming', () => {
       expect(decodeURIComponent(shimmed.href)).to.equal(final);
     });
   });
+
+  describe('token shimming', () => {
+    it('converts token query parameters to an authorization header', () => {
+      const url = 'wss://localhost?token=12345';
+      const shimmed = moveTokenToHeader({
+        url,
+        headers: {},
+      } as unknown as http.IncomingMessage);
+
+      expect(shimmed).not.to.include('?token=');
+    });
+
+    it('converts the token to a proper header', () => {
+      const url = 'wss://localhost?token=12345';
+      const request = { url, headers: {} } as unknown as http.IncomingMessage;
+
+      moveTokenToHeader(request);
+
+      expect(request.headers.authorization).to.eql('Bearer 12345');
+    });
+
+    it('does no conversion if an authorization header is already present', () => {
+      const oldAuth = 'Bearer foo-bar';
+      const url = 'wss://localhost?token=12345';
+      const request = {
+        url,
+        headers: { authorization: oldAuth },
+      } as unknown as http.IncomingMessage;
+
+      const shimmed = moveTokenToHeader(request);
+
+      expect(shimmed).not.to.include('?token=');
+      expect(request.headers.authorization).to.eql(oldAuth);
+    });
+  });
 });

package/src/shim.ts

@@ -1,3 +1,4 @@
+import * as http from 'http';
 import {
   CDPLaunchOptions,
   convertIfBase64,
@@ -6,6 +7,22 @@ import {
 
 const shimParam = ['headless', 'stealth', 'ignoreDefaultArgs', 'slowMo'];
 
+/**
+ * Obfuscates the ?token parameter by shifting it to a header instead of a query-parameter.
+ */
+export function moveTokenToHeader(req: http.IncomingMessage): string {
+  const parsed = new URL(req.url || '', 'http://localhost');
+  const token = parsed.searchParams.get('token');
+
+  if (token) {
+    parsed.searchParams.delete('token');
+    req.headers.authorization = req.headers.authorization ?? `Bearer ${token}`;
+    req.url = parsed.pathname + parsed.search;
+  }
+
+  return req.url!;
+}
+
 /**
  * Given a legacy connect or API call, this shim will
  * re-order the arguments to make them valid in the 2.0

package/src/types.ts

@@ -238,6 +238,13 @@ abstract class BasicHTTPRoute extends Route {
    * The allowed methods ("GET", "POST", etc) this route can utilize and match against.
    */
   abstract method: Methods;
+
+  /**
+   * A function that can run before the requests is parsed and any query or body validation is run.
+   * Useful if you need to alter something about the request to conform it or otherwise. This
+   * hook is ran after any "global" hooks have run.
+   */
+  before?: (req: Request, res: http.ServerResponse) => Promise<boolean>;
 }
 
 /**
@@ -299,6 +306,15 @@ export abstract class WebSocketRoute extends Route {
     head: Buffer,
     logger: Logger,
   ): Promise<unknown>;
+
+  /**
+   * Handles an inbound HTTP request, and supplies the Request and Response objects from node's HTTP request event
+   */
+  before?: (
+    req: Request,
+    socket: stream.Duplex,
+    head: Buffer,
+  ) => Promise<boolean>;
 }
 
 /**
@@ -328,6 +344,15 @@ export abstract class BrowserWebsocketRoute extends Route {
    * creation. Useful for injecting behaviors or other functionality.
    */
   onNewPage?: (url: URL, page: Page) => Promise<void>;
+
+  /**
+   * Handles an inbound HTTP request, and supplies the Request and Response objects from node's HTTP request event
+   */
+  before?: (
+    req: Request,
+    socket: stream.Duplex,
+    head: Buffer,
+  ) => Promise<boolean>;
 }
 
 interface BrowserlessLaunch {

package/src/utils.ts

@@ -230,7 +230,7 @@ export const fetchJson = (
   });
 
 export const getTokenFromRequest = (req: Request) => {
-  const authHeader = req.headers['authorization'];
+  const authHeader = req.headers.authorization;
   const tokenParam = req.parsed.searchParams.get('token');
   return tokenParam ?? getAuthHeaderToken(authHeader || '');
 };