@server/next 0.21.11 → 0.21.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.21.11",
+  "version": "0.21.13",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "https://github.com/franciscop/server-next.git",

package/src/helpers/config.js

@@ -12,17 +12,22 @@ export default function config(options = {}) {
 
   // CORS
   options.cors = options.cors || env.CORS || null;
-  if (options.cors === true) {
-    options.cors = { origin: options.domain || "*" };
-  }
-  if (typeof options.cors === "string") {
-    options.cors = { origin: options.cors };
-  }
-  if (options.cors && !options.cors.methods) {
-    options.cors.methods = "GET,HEAD,POST,PUT,PATCH";
-  }
-  if (options.cors && !options.cors.headers) {
-    options.cors.methods = "*";
+  if (options.cors) {
+    if (options.cors === true) {
+      options.cors = { origin: true };
+    }
+    if (typeof options.cors === "string") {
+      options.cors = { origin: options.cors };
+    }
+    if (typeof options.cors.origin === "string") {
+      options.cors.origin = options.cors.origin.toLowerCase();
+    }
+    if (!options.cors.methods) {
+      options.cors.methods = "GET,HEAD,POST,PUT,PATCH";
+    }
+    if (!options.cors.headers) {
+      options.cors.methods = "*";
+    }
   }
 
   // Bucket

package/src/helpers/cors.js

@@ -1,19 +1,32 @@
-export default function cors(headers, options, ctx) {
-  headers.set("Access-Control-Allow-Methods", options.methods);
-  headers.set("Access-Control-Allow-Headers", options.headers);
+// Based on https://expressjs.com/en/resources/middleware/cors.html#configuration-options
+export default function cors(configOrigin, origin = "") {
+  origin = origin.toLowerCase();
 
-  const origin = ctx.headers.origin.toLowerCase();
-  if (!ctx.platform.production && /http:\/\/localhost:\d+/.test(origin)) {
-    return headers.set("Access-Control-Allow-Origin", origin);
-  }
+  // When it's true, reflect the origin
+  if (configOrigin === true) return origin || null;
+
+  // A star should always return a star
+  if (configOrigin === "*") return "*";
+
+  // No origin, it's okay since that means we don't need CORS
+  if (!origin) return null;
 
-  if (options.origin === "*") {
-    return headers.set("Access-Control-Allow-Origin", "*");
+  // Coming from localhost
+  if (/^https?:\/\/localhost(:\d+)?$/.test(origin)) {
+    return origin;
   }
 
-  if (options.origin.toLowerCase().split(/\,\s/g).includes(origin)) {
-    return headers.set("Access-Control-Allow-Origin", origin);
+  if (
+    configOrigin
+      .toLowerCase()
+      .split(/\s*,\s*/g)
+      .includes(origin)
+  ) {
+    return origin;
   }
 
-  throw new Error(`Invalid origin ${origin}`);
+  console.warn(
+    `CORS: Origin "${origin}" not allowed. Allowed origins: ${configOrigin}`,
+  );
+  return null;
 }

package/src/parseResponse.js

@@ -42,7 +42,15 @@ export default async function parseResponse(out, ctx) {
   // If we have CORS, set it up
   if (ctx.options.cors) {
     // Set the proper CORS headers
-    cors(out.headers, ctx.options.cors, ctx);
+    const origin = cors(ctx.options.cors.origin, ctx.headers.origin);
+    if (origin) {
+      headers.set("Access-Control-Allow-Methods", ctx.options.cors.methods);
+      headers.set("Access-Control-Allow-Headers", ctx.options.cors.headers);
+      headers.set("Access-Control-Allow-Origin", origin);
+      if (ctx.options.cors.credentials) {
+        headers.set("Access-Control-Allow-Credentials", "true");
+      }
+    }
   }
 
   // Only attach the headers if the user is using the timing API