@server/next 0.21.9 → 0.21.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.21.9",
+  "version": "0.21.10",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "https://github.com/franciscop/server-next.git",

package/src/helpers/config.js

@@ -21,6 +21,9 @@ export default function config(options = {}) {
   if (options.cors && !options.cors.methods) {
     options.cors.methods = "GET,HEAD,POST,PUT,PATCH";
   }
+  if (options.cors && !options.cors.headers) {
+    options.cors.methods = "*";
+  }
 
   // Bucket
   options.views = options.views ? Bucket(options.views) : null;

package/src/helpers/cors.js

@@ -0,0 +1,19 @@
+export default function cors(headers, options, ctx) {
+  headers.set("Access-Control-Allow-Methods", options.methods);
+  headers.set("Access-Control-Allow-Headers", options.headers);
+
+  const origin = ctx.headers.origin.toLowerCase();
+  if (!ctx.platform.production && /http:\/\/localhost:\d+/.test(origin)) {
+    return headers.set("Access-Control-Allow-Origin", origin);
+  }
+
+  if (options.origin === "*") {
+    return headers.set("Access-Control-Allow-Origin", "*");
+  }
+
+  if (options.origin.toLowerCase().split(/\,\s/g).includes(origin)) {
+    return headers.set("Access-Control-Allow-Origin", origin);
+  }
+
+  throw new Error(`Invalid origin ${origin}`);
+}

package/src/middle/timer.js

@@ -2,4 +2,13 @@ export default function timer(ctx) {
   const times = [["init", performance.now()]];
   ctx.time = (name) => times.push([name, performance.now()]);
   ctx.time.times = times;
+  ctx.time.headers = () => {
+    const r = (t) => Math.round(t);
+    const times = ctx.time.times;
+    const timing = times
+      .slice(1)
+      .map(([name, time], i) => `${name};dur=${r(time - times[i][1])}`)
+      .join(", ");
+    return timing;
+  };
 }

package/src/parseResponse.js

@@ -41,21 +41,14 @@ export default async function parseResponse(out, ctx) {
 
   // If we have CORS, set it up
   if (ctx.options.cors) {
-    const { origin, methods } = ctx.options.cors;
-    out.headers.set("Access-Control-Allow-Origin", origin);
-    out.headers.set("Access-Control-Allow-Methods", methods);
+    // Set the proper CORS headers
+    cors(out.headers, ctx.options.cors, ctx);
   }
 
   // Only attach the headers if the user is using the timing API
   // 1 item is the `init` so it doesn't count
   if (ctx.time.times.length > 1) {
-    const r = (t) => Math.round(t);
-    const times = ctx.time.times;
-    const timing = times
-      .slice(1)
-      .map(([name, time], i) => `${name};dur=${r(time - times[i][1])}`)
-      .join(", ");
-    out.headers.set("Server-Timing", timing);
+    out.headers.set("Server-Timing", ctx.time.headers());
   }
 
   // If we have a session, we need to persist it into a cookie