@middy/http-cors 7.1.0 → 7.1.1

package/README.md

@@ -1,5 +1,5 @@
 <div align="center">
-  <h1>Middy CORS middleware</h1>
+  <h1>Middy `http-cors` middleware</h1>
   <img alt="Middy logo" src="https://raw.githubusercontent.com/middyjs/middy/main/docs/img/middy-logo.svg"/>
   <p><strong>CORS middleware for the middy framework, the stylish Node.js middleware engine for AWS Lambda</strong></p>
   <p>

package/index.d.ts

@@ -15,6 +15,7 @@ export interface Options {
 	requestHeaders?: string[];
 	requestMethods?: string[];
 	cacheControl?: string;
+	vary?: string;
 }
 
 declare function httpCors(options?: Options): middy.MiddlewareObj;

package/index.js

@@ -2,6 +2,25 @@
 // SPDX-License-Identifier: MIT
 import { normalizeHttpResponse } from "@middy/util";
 
+const hostnameToPunycode = (hostname) => {
+	const placeholder = "-_ANY_-";
+	const tempHostname = hostname.replace(/\*/g, placeholder);
+	try {
+		const url = new URL(`https://${tempHostname}`);
+		return url.host.replaceAll(placeholder.toLowerCase(), "*");
+	} catch {
+		return hostname;
+	}
+};
+
+const originToPunycode = (origin) => {
+	if (!origin || origin === "*") return origin;
+	const match = origin.match(/^(https?:\/\/)(.+)$/);
+	if (!match) return origin;
+	const [, protocol, host] = match;
+	return protocol + hostnameToPunycode(host);
+};
+
 // CORS-safelisted request headers
 // https://developer.mozilla.org/en-US/docs/Glossary/CORS-safelisted_request_header
 const corsSafelistedRequestHeaders = [
@@ -66,10 +85,11 @@ const httpCorsMiddleware = (opts = {}) => {
 	const originStatic = {};
 	const originDynamic = [];
 
-	for (const origin of [options.origin, ...options.origins]) {
+	for (let origin of [options.origin, ...options.origins]) {
 		if (!origin) {
 			continue;
 		}
+		origin = originToPunycode(origin);
 		// All
 		if (origin === "*") {
 			originAny = true;
@@ -82,7 +102,6 @@ const httpCorsMiddleware = (opts = {}) => {
 		}
 		originMany = true;
 		// Dynamic
-		// TODO: IDN -> puncycode not handled, add in if requested
 		const regExpStr = origin
 			.replace(/[.+?^${}()|[\]\\]/g, "\\$&")
 			.replaceAll("*", "[^.]*");
@@ -227,7 +246,7 @@ const getVersionHttpMethod = {
 	"2.0": (event) => event.requestContext.http.method,
 };
 
-// header in offical name, lowercase varient handeled
+// header in official name, lowercase variant handled
 const addHeaderPart = (headers, header, value) => {
 	if (!value) return;
 	const headerLower = header.toLowerCase();

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@middy/http-cors",
-	"version": "7.1.0",
+	"version": "7.1.1",
 	"description": "CORS (Cross-Origin Resource Sharing) middleware for the middy framework",
 	"type": "module",
 	"engines": {
@@ -65,9 +65,10 @@
 	},
 	"gitHead": "7a6c0fbb8ab71d6a2171e678697de9f237568431",
 	"dependencies": {
-		"@middy/util": "7.1.0"
+		"@middy/util": "7.1.1"
 	},
 	"devDependencies": {
-		"@middy/core": "7.1.0"
+		"@middy/core": "7.1.1",
+		"@types/aws-lambda": "^8.0.0"
 	}
 }