@middy/http-cors 5.5.1 → 6.0.0-beta.0

package/index.js

@@ -6,19 +6,15 @@ const defaults = {
   credentials: undefined,
   headers: undefined,
   methods: undefined,
-  origin: '*',
+  origin: undefined,
   origins: [],
   exposeHeaders: undefined,
   maxAge: undefined,
-  requestHeaders: undefined,
-  requestMethods: undefined,
   cacheControl: undefined,
   vary: undefined
 }
+
 const httpCorsMiddleware = (opts = {}) => {
-  let originAny = false
-  const originStatic = {}
-  const originDynamic = []
   const getOrigin = (incomingOrigin, options = {}) => {
     if (options.origins.length > 0) {
       if (originStatic[incomingOrigin]) {
@@ -49,10 +45,13 @@ const httpCorsMiddleware = (opts = {}) => {
     ...opts
   }
 
-  for (const origin of options.origins) {
-    // Static
-    if (origin.indexOf('*') < 0) {
-      originStatic[origin] = true
+  let originAny = false
+  let originMany = options.origins.length > 1
+  const originStatic = {}
+  const originDynamic = []
+
+  for (const origin of [options.origin, ...options.origins]) {
+    if (!origin) {
       continue
     }
     // All
@@ -60,12 +59,83 @@ const httpCorsMiddleware = (opts = {}) => {
       originAny = true
       continue
     }
+    // Static
+    if (!origin.includes('*')) {
+      originStatic[origin] = true
+      continue
+    }
+    originMany = true
     // Dynamic
     // TODO: IDN -> puncycode not handled, add in if requested
     const regExpStr = origin.replaceAll('.', '\\.').replaceAll('*', '[^.]*')
     originDynamic.push(new RegExp(`^${regExpStr}$`))
   }
 
+  const modifyHeaders = (headers, options, request) => {
+    const existingHeaders = Object.keys(headers)
+    if (existingHeaders.includes('Access-Control-Allow-Credentials')) {
+      options.credentials =
+        headers['Access-Control-Allow-Credentials'] === 'true'
+    }
+    if (options.credentials) {
+      headers['Access-Control-Allow-Credentials'] = String(options.credentials)
+    }
+    if (
+      options.headers &&
+      !existingHeaders.includes('Access-Control-Allow-Headers')
+    ) {
+      headers['Access-Control-Allow-Headers'] = options.headers
+    }
+    if (
+      options.methods &&
+      !existingHeaders.includes('Access-Control-Allow-Methods')
+    ) {
+      headers['Access-Control-Allow-Methods'] = options.methods
+    }
+
+    let newOrigin
+    if (!existingHeaders.includes('Access-Control-Allow-Origin')) {
+      const eventHeaders = request.event.headers ?? {}
+      const incomingOrigin = eventHeaders.Origin ?? eventHeaders.origin
+      newOrigin = options.getOrigin(incomingOrigin, options)
+      if (newOrigin) {
+        headers['Access-Control-Allow-Origin'] = newOrigin
+      }
+    }
+
+    if (!headers.Vary) {
+      addHeaderPart(headers, 'Vary', options.vary)
+    }
+
+    if (
+      originMany ||
+      (originAny && newOrigin !== '*') ||
+      (newOrigin === '*' && options.credentials)
+    ) {
+      addHeaderPart(headers, 'Vary', 'Origin')
+    }
+
+    if (
+      options.exposeHeaders &&
+      !existingHeaders.includes('Access-Control-Expose-Headers')
+    ) {
+      headers['Access-Control-Expose-Headers'] = options.exposeHeaders
+    }
+    if (options.maxAge && !existingHeaders.includes('Access-Control-Max-Age')) {
+      headers['Access-Control-Max-Age'] = String(options.maxAge)
+    }
+    const httpMethod = getVersionHttpMethod[request.event.version ?? '1.0']?.(
+      request.event
+    )
+    if (
+      httpMethod === 'OPTIONS' &&
+      options.cacheControl &&
+      !existingHeaders.includes('Cache-Control')
+    ) {
+      headers['Cache-Control'] = options.cacheControl
+    }
+  }
+
   const httpCorsMiddlewareBefore = async (request) => {
     if (options.disableBeforePreflightResponse) return
 
@@ -103,76 +173,14 @@ const getVersionHttpMethod = {
   '2.0': (event) => event.requestContext.http.method
 }
 
-const modifyHeaders = (headers, options, request) => {
-  const existingHeaders = Object.keys(headers)
-  if (existingHeaders.includes('Access-Control-Allow-Credentials')) {
-    options.credentials = headers['Access-Control-Allow-Credentials'] === 'true'
-  }
-  if (options.credentials) {
-    headers['Access-Control-Allow-Credentials'] = String(options.credentials)
-  }
-  if (
-    options.headers &&
-    !existingHeaders.includes('Access-Control-Allow-Headers')
-  ) {
-    headers['Access-Control-Allow-Headers'] = options.headers
-  }
-  if (
-    options.methods &&
-    !existingHeaders.includes('Access-Control-Allow-Methods')
-  ) {
-    headers['Access-Control-Allow-Methods'] = options.methods
-  }
-  if (!existingHeaders.includes('Access-Control-Allow-Origin')) {
-    const eventHeaders = request.event.headers ?? {}
-    const incomingOrigin = eventHeaders.Origin ?? eventHeaders.origin
-    const newOrigin = options.getOrigin(incomingOrigin, options)
-    if (newOrigin) {
-      headers['Access-Control-Allow-Origin'] = newOrigin
-    }
-  }
-  let vary = options.vary
-  if (
-    headers['Access-Control-Allow-Origin'] &&
-    headers['Access-Control-Allow-Origin'] !== '*' &&
-    !vary
-  ) {
-    vary = 'Origin'
-  }
-  if (vary && !existingHeaders.includes('Vary')) {
-    headers.Vary = vary
-  }
-  if (
-    options.exposeHeaders &&
-    !existingHeaders.includes('Access-Control-Expose-Headers')
-  ) {
-    headers['Access-Control-Expose-Headers'] = options.exposeHeaders
-  }
-  if (options.maxAge && !existingHeaders.includes('Access-Control-Max-Age')) {
-    headers['Access-Control-Max-Age'] = String(options.maxAge)
-  }
-  if (
-    options.requestHeaders &&
-    !existingHeaders.includes('Access-Control-Request-Headers')
-  ) {
-    headers['Access-Control-Request-Headers'] = options.requestHeaders
-  }
-  if (
-    options.requestMethods &&
-    !existingHeaders.includes('Access-Control-Request-Methods')
-  ) {
-    headers['Access-Control-Request-Methods'] = options.requestMethods
-  }
-  const httpMethod = getVersionHttpMethod[request.event.version ?? '1.0']?.(
-    request.event
-  )
-  if (
-    httpMethod === 'OPTIONS' &&
-    options.cacheControl &&
-    !existingHeaders.includes('Cache-Control')
-  ) {
-    headers['Cache-Control'] = options.cacheControl
-  }
+// header in offical name, lowercase varient handeled
+const addHeaderPart = (headers, header, value) => {
+  if (!value) return
+  const headerLower = header.toLowerCase()
+  header = headers[headerLower] ? headerLower : header
+  headers[header] ??= ''
+  headers[header] &&= headers[header] + ', '
+  headers[header] += value
 }
 
 export default httpCorsMiddleware

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@middy/http-cors",
-  "version": "5.5.1",
+  "version": "6.0.0-beta.0",
   "description": "CORS (Cross-Origin Resource Sharing) middleware for the middy framework",
   "type": "module",
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "engineStrict": true,
   "publishConfig": {
@@ -16,6 +16,9 @@
       "import": {
         "types": "./index.d.ts",
         "default": "./index.js"
+      },
+      "require": {
+        "default": "./index.js"
       }
     }
   },
@@ -60,9 +63,9 @@
   },
   "gitHead": "7a6c0fbb8ab71d6a2171e678697de9f237568431",
   "dependencies": {
-    "@middy/util": "5.5.1"
+    "@middy/util": "6.0.0-beta.0"
   },
   "devDependencies": {
-    "@middy/core": "5.5.1"
+    "@middy/core": "6.0.0-beta.0"
   }
 }