@server/next 0.21.12 → 0.21.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.21.12",
+  "version": "0.21.13",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "https://github.com/franciscop/server-next.git",

package/src/helpers/config.js

@@ -12,20 +12,22 @@ export default function config(options = {}) {
 
   // CORS
   options.cors = options.cors || env.CORS || null;
-  if (options.cors === true) {
-    options.cors = { origin: options.domain || "*" };
-  }
-  if (typeof options.cors === "string") {
-    options.cors = { origin: options.cors };
-  }
-  if (options.cors && typeof options.cors.origin === "string") {
-    options.cors.origin = options.cors.origin.toLowerCase();
-  }
-  if (options.cors && !options.cors.methods) {
-    options.cors.methods = "GET,HEAD,POST,PUT,PATCH";
-  }
-  if (options.cors && !options.cors.headers) {
-    options.cors.methods = "*";
+  if (options.cors) {
+    if (options.cors === true) {
+      options.cors = { origin: true };
+    }
+    if (typeof options.cors === "string") {
+      options.cors = { origin: options.cors };
+    }
+    if (typeof options.cors.origin === "string") {
+      options.cors.origin = options.cors.origin.toLowerCase();
+    }
+    if (!options.cors.methods) {
+      options.cors.methods = "GET,HEAD,POST,PUT,PATCH";
+    }
+    if (!options.cors.headers) {
+      options.cors.methods = "*";
+    }
   }
 
   // Bucket

package/src/helpers/cors.js

@@ -1,24 +1,32 @@
+// Based on https://expressjs.com/en/resources/middleware/cors.html#configuration-options
 export default function cors(configOrigin, origin = "") {
+  origin = origin.toLowerCase();
+
+  // When it's true, reflect the origin
+  if (configOrigin === true) return origin || null;
+
   // A star should always return a star
   if (configOrigin === "*") return "*";
 
-  origin = origin.toLowerCase();
-
-  // No origin
-  if (!origin) {
-    console.warn("CORS: Missing Origin header");
-    return null;
-  }
+  // No origin, it's okay since that means we don't need CORS
+  if (!origin) return null;
 
   // Coming from localhost
   if (/^https?:\/\/localhost(:\d+)?$/.test(origin)) {
     return origin;
   }
 
-  if (configOrigin.toLowerCase().split(/\,\s/g).includes(origin)) {
+  if (
+    configOrigin
+      .toLowerCase()
+      .split(/\s*,\s*/g)
+      .includes(origin)
+  ) {
     return origin;
   }
 
-  console.warn(`CORS: Origin "${origin}" is not allowed`);
+  console.warn(
+    `CORS: Origin "${origin}" not allowed. Allowed origins: ${configOrigin}`,
+  );
   return null;
 }

package/src/parseResponse.js

@@ -42,11 +42,14 @@ export default async function parseResponse(out, ctx) {
   // If we have CORS, set it up
   if (ctx.options.cors) {
     // Set the proper CORS headers
-    const origin = cors(ctx.options.cors, ctx.headers.origin);
+    const origin = cors(ctx.options.cors.origin, ctx.headers.origin);
     if (origin) {
-      headers.set("Access-Control-Allow-Methods", options.methods);
-      headers.set("Access-Control-Allow-Headers", options.headers);
+      headers.set("Access-Control-Allow-Methods", ctx.options.cors.methods);
+      headers.set("Access-Control-Allow-Headers", ctx.options.cors.headers);
       headers.set("Access-Control-Allow-Origin", origin);
+      if (ctx.options.cors.credentials) {
+        headers.set("Access-Control-Allow-Credentials", "true");
+      }
     }
   }