@server/next 0.21.10 → 0.21.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.21.10",
+  "version": "0.21.12",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "https://github.com/franciscop/server-next.git",

package/src/helpers/config.js

@@ -18,6 +18,9 @@ export default function config(options = {}) {
   if (typeof options.cors === "string") {
     options.cors = { origin: options.cors };
   }
+  if (options.cors && typeof options.cors.origin === "string") {
+    options.cors.origin = options.cors.origin.toLowerCase();
+  }
   if (options.cors && !options.cors.methods) {
     options.cors.methods = "GET,HEAD,POST,PUT,PATCH";
   }

package/src/helpers/cors.js

@@ -1,19 +1,24 @@
-export default function cors(headers, options, ctx) {
-  headers.set("Access-Control-Allow-Methods", options.methods);
-  headers.set("Access-Control-Allow-Headers", options.headers);
+export default function cors(configOrigin, origin = "") {
+  // A star should always return a star
+  if (configOrigin === "*") return "*";
 
-  const origin = ctx.headers.origin.toLowerCase();
-  if (!ctx.platform.production && /http:\/\/localhost:\d+/.test(origin)) {
-    return headers.set("Access-Control-Allow-Origin", origin);
+  origin = origin.toLowerCase();
+
+  // No origin
+  if (!origin) {
+    console.warn("CORS: Missing Origin header");
+    return null;
   }
 
-  if (options.origin === "*") {
-    return headers.set("Access-Control-Allow-Origin", "*");
+  // Coming from localhost
+  if (/^https?:\/\/localhost(:\d+)?$/.test(origin)) {
+    return origin;
   }
 
-  if (options.origin.toLowerCase().split(/\,\s/g).includes(origin)) {
-    return headers.set("Access-Control-Allow-Origin", origin);
+  if (configOrigin.toLowerCase().split(/\,\s/g).includes(origin)) {
+    return origin;
   }
 
-  throw new Error(`Invalid origin ${origin}`);
+  console.warn(`CORS: Origin "${origin}" is not allowed`);
+  return null;
 }

package/src/helpers/index.js

@@ -1,6 +1,7 @@
 export { default as createCookies } from "./createCookies.js";
 export { default as createId } from "./createId.js";
 export { default as config } from "./config.js";
+export { default as cors } from "./cors.js";
 export { default as define } from "./define.js";
 export { default as getMachine } from "./getMachine.js";
 export { default as handleRequest } from "./handleRequest.js";

package/src/parseResponse.js

@@ -1,6 +1,6 @@
 // import { Readable } from "node:stream";
 
-import { createCookies, createId } from "./helpers/index.js";
+import { cors, createCookies, createId } from "./helpers/index.js";
 import { json } from "./reply.js";
 import ServerError from "./ServerError.js";
 
@@ -42,7 +42,12 @@ export default async function parseResponse(out, ctx) {
   // If we have CORS, set it up
   if (ctx.options.cors) {
     // Set the proper CORS headers
-    cors(out.headers, ctx.options.cors, ctx);
+    const origin = cors(ctx.options.cors, ctx.headers.origin);
+    if (origin) {
+      headers.set("Access-Control-Allow-Methods", options.methods);
+      headers.set("Access-Control-Allow-Headers", options.headers);
+      headers.set("Access-Control-Allow-Origin", origin);
+    }
   }
 
   // Only attach the headers if the user is using the timing API