@salesforce/core 6.7.2 → 6.7.3

package/lib/webOAuthServer.d.ts

@@ -141,6 +141,13 @@ export declare class WebServer extends AsyncCreatable<WebServer.Options> {
      * @param response the HTTP response.
      */
     reportSuccess(response: http.ServerResponse): void;
+    /**
+     * Preflight request:
+     *
+     * https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
+     * https://www.w3.org/TR/2020/SPSD-cors-20200602/#resource-preflight-requests
+     */
+    handlePreflightRequest(response: http.ServerResponse): void;
     handleSuccess(response: http.ServerResponse): Promise<void>;
     handleError(response: http.ServerResponse): Promise<void>;
     protected init(): Promise<void>;

package/lib/webOAuthServer.js

@@ -212,6 +212,11 @@ class WebOAuthServer extends kit_1.AsyncCreatable {
                             reject(new sfError_1.SfError(errMessage, errName));
                         }
                     }
+                    else if (request.method === 'OPTIONS' &&
+                        request.headers['access-control-request-private-network'] === 'true' &&
+                        request.headers['access-control-request-method']) {
+                        this.webServer.handlePreflightRequest(response);
+                    }
                     else {
                         this.webServer.sendError(405, 'Unsupported http methods', response);
                         const errName = 'invalidRequestMethod';
@@ -392,6 +397,21 @@ class WebServer extends kit_1.AsyncCreatable {
         response.end(body);
         this.redirectStatus.emit('complete');
     }
+    /**
+     * Preflight request:
+     *
+     * https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
+     * https://www.w3.org/TR/2020/SPSD-cors-20200602/#resource-preflight-requests
+     */
+    handlePreflightRequest(response) {
+        // We don't validate the origin here because:
+        // 1. The default login URL (login.salesforce.com) will not match after a redirect or if user choose a custom domain in login.
+        // 2. There's no fixed list of auth URLs we could check against.
+        response.statusCode = 204; // No Content response
+        response.setHeader('Access-Control-Allow-Methods', 'GET');
+        response.setHeader('Access-Control-Request-Headers', 'GET');
+        response.end();
+    }
     async handleSuccess(response) {
         return this.handleRedirect(response, '/OauthSuccess');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/core",
-  "version": "6.7.2",
+  "version": "6.7.3",
   "description": "Core libraries to interact with SFDX projects, orgs, and APIs.",
   "main": "lib/index",
   "types": "lib/index.d.ts",