@middy/http-cors 3.0.1 → 3.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +1 -1
- package/README.md +4 -3
- package/index.cjs +104 -1
- package/index.js +98 -1
- package/package.json +4 -4
package/LICENSE
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
MIT License
|
|
2
2
|
|
|
3
|
-
Copyright (c) 2017-2022 Luciano Mammino, will Farrell and the [Middy team](https://github.com/middyjs/middy/graphs/contributors)
|
|
3
|
+
Copyright (c) 2017-2022 [Luciano Mammino](https://github.com/lmammino), [will Farrell](https://github.com/willfarrell) and the [Middy team](https://github.com/middyjs/middy/graphs/contributors)
|
|
4
4
|
|
|
5
5
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
6
|
of this software and associated documentation files (the "Software"), to deal
|
package/README.md
CHANGED
|
@@ -9,8 +9,8 @@
|
|
|
9
9
|
<a href="https://packagephobia.com/result?p=@middy/http-cors">
|
|
10
10
|
<img src="https://packagephobia.com/badge?p=@middy/http-cors" alt="npm install size" style="max-width:100%;">
|
|
11
11
|
</a>
|
|
12
|
-
<a href="https://github.com/middyjs/middy/actions">
|
|
13
|
-
<img src="https://github.com/middyjs/middy/workflows/
|
|
12
|
+
<a href="https://github.com/middyjs/middy/actions/workflows/tests.yml">
|
|
13
|
+
<img src="https://github.com/middyjs/middy/actions/workflows/tests.yml/badge.svg?branch=main&event=push" alt="GitHub Actions CI status badge" style="max-width:100%;">
|
|
14
14
|
</a>
|
|
15
15
|
<br/>
|
|
16
16
|
<a href="https://standardjs.com/">
|
|
@@ -33,6 +33,7 @@
|
|
|
33
33
|
<img src="https://img.shields.io/badge/StackOverflow-[middy]-yellow" alt="Ask questions on StackOverflow" style="max-width:100%;">
|
|
34
34
|
</a>
|
|
35
35
|
</p>
|
|
36
|
+
<p>You can read the documentation at: <a href="https://middy.js.org/docs/middlewares/http-cors">https://middy.js.org/docs/middlewares/http-cors</a></p>
|
|
36
37
|
</div>
|
|
37
38
|
|
|
38
39
|
This middleware sets HTTP CORS headers (`Access-Control-Allow-Origin`, `Access-Control-Allow-Headers`, `Access-Control-Allow-Credentials`), necessary for making cross-origin requests, to the response object.
|
|
@@ -115,7 +116,7 @@ Everyone is very welcome to contribute to this repository. Feel free to [raise i
|
|
|
115
116
|
|
|
116
117
|
## License
|
|
117
118
|
|
|
118
|
-
Licensed under [MIT License](LICENSE). Copyright (c) 2017-2022 Luciano Mammino, will Farrell, and the [Middy team](https://github.com/middyjs/middy/graphs/contributors).
|
|
119
|
+
Licensed under [MIT License](LICENSE). Copyright (c) 2017-2022 [Luciano Mammino](https://github.com/lmammino), [will Farrell](https://github.com/willfarrell), and the [Middy team](https://github.com/middyjs/middy/graphs/contributors).
|
|
119
120
|
|
|
120
121
|
<a href="https://app.fossa.io/projects/git%2Bgithub.com%2Fmiddyjs%2Fmiddy?ref=badge_large">
|
|
121
122
|
<img src="https://app.fossa.io/api/projects/git%2Bgithub.com%2Fmiddyjs%2Fmiddy.svg?type=large" alt="FOSSA Status" style="max-width:100%;">
|
package/index.cjs
CHANGED
|
@@ -1,3 +1,106 @@
|
|
|
1
|
-
"use strict";
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", {
|
|
3
|
+
value: true
|
|
4
|
+
});
|
|
5
|
+
module.exports = void 0;
|
|
6
|
+
var _util = require("@middy/util");
|
|
7
|
+
const getOrigin = (incomingOrigin, options = {})=>{
|
|
8
|
+
if (options.origins.length > 0) {
|
|
9
|
+
if (incomingOrigin && options.origins.includes(incomingOrigin)) {
|
|
10
|
+
return incomingOrigin;
|
|
11
|
+
} else {
|
|
12
|
+
return options.origins[0];
|
|
13
|
+
}
|
|
14
|
+
} else {
|
|
15
|
+
if (incomingOrigin && options.credentials && options.origin === '*') {
|
|
16
|
+
return incomingOrigin;
|
|
17
|
+
}
|
|
18
|
+
return options.origin;
|
|
19
|
+
}
|
|
20
|
+
};
|
|
21
|
+
const defaults = {
|
|
22
|
+
getOrigin,
|
|
23
|
+
credentials: undefined,
|
|
24
|
+
headers: undefined,
|
|
25
|
+
methods: undefined,
|
|
26
|
+
origin: '*',
|
|
27
|
+
origins: [],
|
|
28
|
+
exposeHeaders: undefined,
|
|
29
|
+
maxAge: undefined,
|
|
30
|
+
requestHeaders: undefined,
|
|
31
|
+
requestMethods: undefined,
|
|
32
|
+
cacheControl: undefined,
|
|
33
|
+
vary: undefined
|
|
34
|
+
};
|
|
35
|
+
const httpCorsMiddleware = (opts = {})=>{
|
|
36
|
+
const options = {
|
|
37
|
+
...defaults,
|
|
38
|
+
...opts
|
|
39
|
+
};
|
|
40
|
+
const httpCorsMiddlewareAfter = async (request)=>{
|
|
41
|
+
(0, _util).normalizeHttpResponse(request);
|
|
42
|
+
const { headers } = request.response;
|
|
43
|
+
const existingHeaders = Object.keys(headers);
|
|
44
|
+
if (existingHeaders.includes('Access-Control-Allow-Credentials')) {
|
|
45
|
+
options.credentials = headers['Access-Control-Allow-Credentials'] === 'true';
|
|
46
|
+
}
|
|
47
|
+
if (options.credentials) {
|
|
48
|
+
headers['Access-Control-Allow-Credentials'] = String(options.credentials);
|
|
49
|
+
}
|
|
50
|
+
if (options.headers && !existingHeaders.includes('Access-Control-Allow-Headers')) {
|
|
51
|
+
headers['Access-Control-Allow-Headers'] = options.headers;
|
|
52
|
+
}
|
|
53
|
+
if (options.methods && !existingHeaders.includes('Access-Control-Allow-Methods')) {
|
|
54
|
+
headers['Access-Control-Allow-Methods'] = options.methods;
|
|
55
|
+
}
|
|
56
|
+
if (!existingHeaders.includes('Access-Control-Allow-Origin')) {
|
|
57
|
+
const eventHeaders = request.event.headers ?? {};
|
|
58
|
+
const incomingOrigin = eventHeaders.Origin ?? eventHeaders.origin;
|
|
59
|
+
headers['Access-Control-Allow-Origin'] = options.getOrigin(incomingOrigin, options);
|
|
60
|
+
}
|
|
61
|
+
let vary = options.vary;
|
|
62
|
+
if (headers['Access-Control-Allow-Origin'] !== '*' && !vary) {
|
|
63
|
+
vary = 'Origin';
|
|
64
|
+
}
|
|
65
|
+
if (vary && !existingHeaders.includes('Vary')) {
|
|
66
|
+
headers.Vary = vary;
|
|
67
|
+
}
|
|
68
|
+
if (options.exposeHeaders && !existingHeaders.includes('Access-Control-Expose-Headers')) {
|
|
69
|
+
headers['Access-Control-Expose-Headers'] = options.exposeHeaders;
|
|
70
|
+
}
|
|
71
|
+
if (options.maxAge && !existingHeaders.includes('Access-Control-Max-Age')) {
|
|
72
|
+
headers['Access-Control-Max-Age'] = String(options.maxAge);
|
|
73
|
+
}
|
|
74
|
+
if (options.requestHeaders && !existingHeaders.includes('Access-Control-Request-Headers')) {
|
|
75
|
+
headers['Access-Control-Request-Headers'] = options.requestHeaders;
|
|
76
|
+
}
|
|
77
|
+
if (options.requestMethods && !existingHeaders.includes('Access-Control-Request-Methods')) {
|
|
78
|
+
headers['Access-Control-Request-Methods'] = options.requestMethods;
|
|
79
|
+
}
|
|
80
|
+
const httpMethod = getVersionHttpMethod[request.event.version ?? '1.0']?.(request.event);
|
|
81
|
+
if (!httpMethod) {
|
|
82
|
+
throw new Error('[http-cors] Unknown http event format');
|
|
83
|
+
}
|
|
84
|
+
if (httpMethod === 'OPTIONS' && options.cacheControl && !existingHeaders.includes('Cache-Control')) {
|
|
85
|
+
headers['Cache-Control'] = options.cacheControl;
|
|
86
|
+
}
|
|
87
|
+
request.response.headers = headers;
|
|
88
|
+
};
|
|
89
|
+
const httpCorsMiddlewareOnError = async (request)=>{
|
|
90
|
+
if (request.response === undefined) return;
|
|
91
|
+
return httpCorsMiddlewareAfter(request);
|
|
92
|
+
};
|
|
93
|
+
return {
|
|
94
|
+
after: httpCorsMiddlewareAfter,
|
|
95
|
+
onError: httpCorsMiddlewareOnError
|
|
96
|
+
};
|
|
97
|
+
};
|
|
98
|
+
const getVersionHttpMethod = {
|
|
99
|
+
'1.0': (event)=>event.httpMethod,
|
|
100
|
+
'2.0': (event)=>event.requestContext.http.method
|
|
101
|
+
};
|
|
102
|
+
var _default = httpCorsMiddleware;
|
|
103
|
+
module.exports = _default;
|
|
104
|
+
|
|
2
105
|
|
|
3
106
|
//# sourceMappingURL=index.cjs.map
|
package/index.js
CHANGED
|
@@ -1,3 +1,100 @@
|
|
|
1
|
-
import{normalizeHttpResponse}from
|
|
1
|
+
import { normalizeHttpResponse } from '@middy/util';
|
|
2
|
+
const getOrigin = (incomingOrigin, options = {})=>{
|
|
3
|
+
if (options.origins.length > 0) {
|
|
4
|
+
if (incomingOrigin && options.origins.includes(incomingOrigin)) {
|
|
5
|
+
return incomingOrigin;
|
|
6
|
+
} else {
|
|
7
|
+
return options.origins[0];
|
|
8
|
+
}
|
|
9
|
+
} else {
|
|
10
|
+
if (incomingOrigin && options.credentials && options.origin === '*') {
|
|
11
|
+
return incomingOrigin;
|
|
12
|
+
}
|
|
13
|
+
return options.origin;
|
|
14
|
+
}
|
|
15
|
+
};
|
|
16
|
+
const defaults = {
|
|
17
|
+
getOrigin,
|
|
18
|
+
credentials: undefined,
|
|
19
|
+
headers: undefined,
|
|
20
|
+
methods: undefined,
|
|
21
|
+
origin: '*',
|
|
22
|
+
origins: [],
|
|
23
|
+
exposeHeaders: undefined,
|
|
24
|
+
maxAge: undefined,
|
|
25
|
+
requestHeaders: undefined,
|
|
26
|
+
requestMethods: undefined,
|
|
27
|
+
cacheControl: undefined,
|
|
28
|
+
vary: undefined
|
|
29
|
+
};
|
|
30
|
+
const httpCorsMiddleware = (opts = {})=>{
|
|
31
|
+
const options = {
|
|
32
|
+
...defaults,
|
|
33
|
+
...opts
|
|
34
|
+
};
|
|
35
|
+
const httpCorsMiddlewareAfter = async (request)=>{
|
|
36
|
+
normalizeHttpResponse(request);
|
|
37
|
+
const { headers } = request.response;
|
|
38
|
+
const existingHeaders = Object.keys(headers);
|
|
39
|
+
if (existingHeaders.includes('Access-Control-Allow-Credentials')) {
|
|
40
|
+
options.credentials = headers['Access-Control-Allow-Credentials'] === 'true';
|
|
41
|
+
}
|
|
42
|
+
if (options.credentials) {
|
|
43
|
+
headers['Access-Control-Allow-Credentials'] = String(options.credentials);
|
|
44
|
+
}
|
|
45
|
+
if (options.headers && !existingHeaders.includes('Access-Control-Allow-Headers')) {
|
|
46
|
+
headers['Access-Control-Allow-Headers'] = options.headers;
|
|
47
|
+
}
|
|
48
|
+
if (options.methods && !existingHeaders.includes('Access-Control-Allow-Methods')) {
|
|
49
|
+
headers['Access-Control-Allow-Methods'] = options.methods;
|
|
50
|
+
}
|
|
51
|
+
if (!existingHeaders.includes('Access-Control-Allow-Origin')) {
|
|
52
|
+
const eventHeaders = request.event.headers ?? {};
|
|
53
|
+
const incomingOrigin = eventHeaders.Origin ?? eventHeaders.origin;
|
|
54
|
+
headers['Access-Control-Allow-Origin'] = options.getOrigin(incomingOrigin, options);
|
|
55
|
+
}
|
|
56
|
+
let vary = options.vary;
|
|
57
|
+
if (headers['Access-Control-Allow-Origin'] !== '*' && !vary) {
|
|
58
|
+
vary = 'Origin';
|
|
59
|
+
}
|
|
60
|
+
if (vary && !existingHeaders.includes('Vary')) {
|
|
61
|
+
headers.Vary = vary;
|
|
62
|
+
}
|
|
63
|
+
if (options.exposeHeaders && !existingHeaders.includes('Access-Control-Expose-Headers')) {
|
|
64
|
+
headers['Access-Control-Expose-Headers'] = options.exposeHeaders;
|
|
65
|
+
}
|
|
66
|
+
if (options.maxAge && !existingHeaders.includes('Access-Control-Max-Age')) {
|
|
67
|
+
headers['Access-Control-Max-Age'] = String(options.maxAge);
|
|
68
|
+
}
|
|
69
|
+
if (options.requestHeaders && !existingHeaders.includes('Access-Control-Request-Headers')) {
|
|
70
|
+
headers['Access-Control-Request-Headers'] = options.requestHeaders;
|
|
71
|
+
}
|
|
72
|
+
if (options.requestMethods && !existingHeaders.includes('Access-Control-Request-Methods')) {
|
|
73
|
+
headers['Access-Control-Request-Methods'] = options.requestMethods;
|
|
74
|
+
}
|
|
75
|
+
const httpMethod = getVersionHttpMethod[request.event.version ?? '1.0']?.(request.event);
|
|
76
|
+
if (!httpMethod) {
|
|
77
|
+
throw new Error('[http-cors] Unknown http event format');
|
|
78
|
+
}
|
|
79
|
+
if (httpMethod === 'OPTIONS' && options.cacheControl && !existingHeaders.includes('Cache-Control')) {
|
|
80
|
+
headers['Cache-Control'] = options.cacheControl;
|
|
81
|
+
}
|
|
82
|
+
request.response.headers = headers;
|
|
83
|
+
};
|
|
84
|
+
const httpCorsMiddlewareOnError = async (request)=>{
|
|
85
|
+
if (request.response === undefined) return;
|
|
86
|
+
return httpCorsMiddlewareAfter(request);
|
|
87
|
+
};
|
|
88
|
+
return {
|
|
89
|
+
after: httpCorsMiddlewareAfter,
|
|
90
|
+
onError: httpCorsMiddlewareOnError
|
|
91
|
+
};
|
|
92
|
+
};
|
|
93
|
+
const getVersionHttpMethod = {
|
|
94
|
+
'1.0': (event)=>event.httpMethod,
|
|
95
|
+
'2.0': (event)=>event.requestContext.http.method
|
|
96
|
+
};
|
|
97
|
+
export default httpCorsMiddleware;
|
|
98
|
+
|
|
2
99
|
|
|
3
100
|
//# sourceMappingURL=index.js.map
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@middy/http-cors",
|
|
3
|
-
"version": "3.0.
|
|
3
|
+
"version": "3.0.4",
|
|
4
4
|
"description": "CORS (Cross-Origin Resource Sharing) middleware for the middy framework",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"engines": {
|
|
@@ -53,11 +53,11 @@
|
|
|
53
53
|
"url": "https://github.com/middyjs/middy/issues"
|
|
54
54
|
},
|
|
55
55
|
"homepage": "https://middy.js.org",
|
|
56
|
-
"gitHead": "
|
|
56
|
+
"gitHead": "3e9bc83e791f943c71cd7003fc27f0a3692d83a1",
|
|
57
57
|
"dependencies": {
|
|
58
|
-
"@middy/util": "
|
|
58
|
+
"@middy/util": "3.0.4"
|
|
59
59
|
},
|
|
60
60
|
"devDependencies": {
|
|
61
|
-
"@middy/core": "
|
|
61
|
+
"@middy/core": "3.0.4"
|
|
62
62
|
}
|
|
63
63
|
}
|