@middy/http-cors 7.0.2 → 7.1.0

package/README.md

@@ -5,7 +5,7 @@
   <p>
     <a href="https://github.com/middyjs/middy/actions/workflows/test-unit.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-unit.yml/badge.svg" alt="GitHub Actions unit test status"></a>
     <a href="https://github.com/middyjs/middy/actions/workflows/test-dast.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-dast.yml/badge.svg" alt="GitHub Actions dast test status"></a>
-    <a href="https://github.com/middyjs/middy/actions/workflows/test-perf.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-pref.yml/badge.svg" alt="GitHub Actions perf test status"></a>
+    <a href="https://github.com/middyjs/middy/actions/workflows/test-perf.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-perf.yml/badge.svg" alt="GitHub Actions perf test status"></a>
     <a href="https://github.com/middyjs/middy/actions/workflows/test-sast.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-sast.yml/badge.svg" alt="GitHub Actions SAST test status"></a>
     <a href="https://github.com/middyjs/middy/actions/workflows/test-lint.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-lint.yml/badge.svg" alt="GitHub Actions lint test status"></a>
     <br/>
@@ -32,7 +32,7 @@
 
 ## License
 
-Licensed under [MIT License](LICENSE). Copyright (c) 2017-2025 [Luciano Mammino](https://github.com/lmammino), [will Farrell](https://github.com/willfarrell), and the [Middy team](https://github.com/middyjs/middy/graphs/contributors).
+Licensed under [MIT License](LICENSE). Copyright (c) 2017-2026 [will Farrell](https://github.com/willfarrell), [Luciano Mammino](https://github.com/lmammino), and [Middy contributors](https://github.com/middyjs/middy/graphs/contributors).
 
 <a href="https://app.fossa.io/projects/git%2Bgithub.com%2Fmiddyjs%2Fmiddy?ref=badge_large">
   <img src="https://app.fossa.io/api/projects/git%2Bgithub.com%2Fmiddyjs%2Fmiddy.svg?type=large" alt="FOSSA Status"  style="max-width:100%;">

package/index.d.ts

@@ -1,3 +1,5 @@
+// Copyright 2017 - 2026 will Farrell, Luciano Mammino, and Middy contributors.
+// SPDX-License-Identifier: MIT
 import type middy from "@middy/core";
 
 export interface Options {
@@ -10,8 +12,8 @@ export interface Options {
 	origins?: string[];
 	exposeHeaders?: string;
 	maxAge?: number | string;
-	requestHeaders?: string;
-	requestMethods?: string;
+	requestHeaders?: string[];
+	requestMethods?: string[];
 	cacheControl?: string;
 }
 

package/index.js

@@ -1,5 +1,17 @@
+// Copyright 2017 - 2026 will Farrell, Luciano Mammino, and Middy contributors.
+// SPDX-License-Identifier: MIT
 import { normalizeHttpResponse } from "@middy/util";
 
+// CORS-safelisted request headers
+// https://developer.mozilla.org/en-US/docs/Glossary/CORS-safelisted_request_header
+const corsSafelistedRequestHeaders = [
+	"accept",
+	"accept-language",
+	"content-language",
+	"content-type",
+	"range",
+];
+
 const defaults = {
 	disableBeforePreflightResponse: true,
 	getOrigin: undefined, // default inserted below
@@ -10,6 +22,8 @@ const defaults = {
 	origins: [],
 	exposeHeaders: undefined,
 	maxAge: undefined,
+	requestHeaders: undefined,
+	requestMethods: undefined,
 	cacheControl: undefined,
 	vary: undefined,
 };
@@ -29,7 +43,7 @@ const httpCorsMiddleware = (opts = {}) => {
 			if (originDynamic.some((regExp) => regExp.test(incomingOrigin))) {
 				return incomingOrigin;
 			}
-			// TODO deprecate `else` in v6
+			// TODO v8 deprecate `else`
 		} else {
 			if (incomingOrigin && options.credentials && options.origin === "*") {
 				return incomingOrigin;
@@ -44,6 +58,9 @@ const httpCorsMiddleware = (opts = {}) => {
 		...opts,
 	};
 
+	options.requestHeaders = options.requestHeaders?.map((v) => v.toLowerCase());
+	options.requestMethods = options.requestMethods?.map((v) => v.toUpperCase());
+
 	let originAny = false;
 	let originMany = options.origins.length > 1;
 	const originStatic = {};
@@ -66,7 +83,9 @@ const httpCorsMiddleware = (opts = {}) => {
 		originMany = true;
 		// Dynamic
 		// TODO: IDN -> puncycode not handled, add in if requested
-		const regExpStr = origin.replaceAll(".", "\\.").replaceAll("*", "[^.]*");
+		const regExpStr = origin
+			.replace(/[.+?^${}()|[\]\\]/g, "\\$&")
+			.replaceAll("*", "[^.]*");
 		// SAST Skipped: Not accessible by users
 		// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
 		originDynamic.push(new RegExp(`^${regExpStr}$`));
@@ -145,6 +164,40 @@ const httpCorsMiddleware = (opts = {}) => {
 		);
 		if (method === "OPTIONS") {
 			normalizeHttpResponse(request);
+			const eventHeaders = request.event.headers ?? {};
+			const requestMethod =
+				eventHeaders["Access-Control-Request-Method"] ??
+				eventHeaders["access-control-request-method"];
+
+			if (options.requestMethods?.length && requestMethod) {
+				if (!options.requestMethods.includes(requestMethod)) {
+					request.response.statusCode = 204;
+					request.response.headers = {};
+					return request.response;
+				}
+			}
+
+			const requestHeadersValue =
+				eventHeaders["Access-Control-Request-Headers"] ??
+				eventHeaders["access-control-request-headers"];
+
+			if (options.requestHeaders?.length && requestHeadersValue) {
+				const requestedHeaders = requestHeadersValue
+					.split(",")
+					.map((h) => h.trim().toLowerCase());
+				const nonSafelistedHeaders = requestedHeaders.filter(
+					(h) => !corsSafelistedRequestHeaders.includes(h),
+				);
+				const hasDisallowedHeader = nonSafelistedHeaders.some(
+					(h) => !options.requestHeaders.includes(h),
+				);
+				if (hasDisallowedHeader) {
+					request.response.statusCode = 204;
+					request.response.headers = {};
+					return request.response;
+				}
+			}
+
 			const headers = {};
 			modifyHeaders(headers, options, request);
 			request.response.headers = headers;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@middy/http-cors",
-	"version": "7.0.2",
+	"version": "7.1.0",
 	"description": "CORS (Cross-Origin Resource Sharing) middleware for the middy framework",
 	"type": "module",
 	"engines": {
@@ -11,6 +11,7 @@
 		"access": "public"
 	},
 	"module": "./index.js",
+	"sideEffects": false,
 	"exports": {
 		".": {
 			"import": {
@@ -64,9 +65,9 @@
 	},
 	"gitHead": "7a6c0fbb8ab71d6a2171e678697de9f237568431",
 	"dependencies": {
-		"@middy/util": "7.0.2"
+		"@middy/util": "7.1.0"
 	},
 	"devDependencies": {
-		"@middy/core": "7.0.2"
+		"@middy/core": "7.1.0"
 	}
 }