@tokenoftrust/storefront-runner 2.2.46 → 2.2.48
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -72,9 +72,15 @@ const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
|
|
|
72
72
|
* is this Worker's own host, so the front door runs this instead with the viewer's
|
|
73
73
|
* origin (astro.config.mjs turns the built-in check off). Same rule otherwise: an
|
|
74
74
|
* unsafe method with a form-like or absent content type must come from `expectedOrigin`.
|
|
75
|
+
*
|
|
76
|
+
* A request carrying a Bearer token is not a form submission. A browser never attaches
|
|
77
|
+
* one on its own (unlike a cookie or cached Basic credentials), and a cross-site script
|
|
78
|
+
* that sets it triggers a CORS preflight this Worker does not grant. Server-to-server
|
|
79
|
+
* writes — CI staging a bundle's `text/plain` objects into R2 — authenticate that way.
|
|
75
80
|
*/
|
|
76
81
|
export function crossSiteFormRefusal(request: Request, expectedOrigin: string): Response | null {
|
|
77
82
|
if (SAFE_METHODS.has(request.method)) return null;
|
|
83
|
+
if (/^bearer\s+\S/i.test(request.headers.get("authorization") ?? "")) return null;
|
|
78
84
|
if (request.headers.get("origin") === expectedOrigin) return null;
|
|
79
85
|
const contentType = request.headers.get("content-type");
|
|
80
86
|
if (contentType !== null) {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@tokenoftrust/storefront-runner",
|
|
3
|
-
"version": "2.2.
|
|
3
|
+
"version": "2.2.48",
|
|
4
4
|
"license": "SEE LICENSE IN LICENSE",
|
|
5
5
|
"description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
|
|
6
6
|
"packageManager": "pnpm@11.9.0",
|