@webpieces/http-routing 0.3.378 → 0.3.380

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-routing",
-  "version": "0.3.378",
+  "version": "0.3.380",
   "description": "Decorator-based routing with auto-wiring for WebPieces",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,9 +22,9 @@
   },
   "dependencies": {
     "@inversifyjs/binding-decorators": "1.1.5",
-    "@webpieces/core-context": "0.3.378",
-    "@webpieces/core-util": "0.3.378",
-    "@webpieces/gcp-identity": "0.3.378",
+    "@webpieces/core-context": "0.3.380",
+    "@webpieces/core-util": "0.3.380",
+    "@webpieces/gcp-identity": "0.3.380",
     "inversify": "7.10.4",
     "jsonwebtoken": "9.0.2",
     "minimatch": "10.0.1"

package/src/WebpiecesConfig.d.ts

@@ -4,13 +4,26 @@
  */
 export declare class WebpiecesConfig {
     /**
-     * EXTRA cross-origin origins to allow, beyond the two that are always allowed: the server's OWN
-     * origin (same-origin — a browser sends `Origin` on every POST, even same-origin, so this is what
-     * lets a server that also serves its own UI answer its own api calls) and `localhost:*` (dev).
+     * The browser origins allowed to call this api CROSS-ORIGIN. Empty/unset (the default) means
+     * CORS middleware is NEVER MOUNTED — leave it that way in production.
      *
-     * Only needed when the browser origin differs from the api origin AND is not localhost — e.g. a
-     * UI on a CDN/custom domain calling an api on a different host. Exact origin match, e.g.
-     * `['https://app.example.com']`.
+     * You almost never want this in production. A server that also serves its own browser app does
+     * NOT need cors: a browser applies no cors check to a same-origin request. Turning cors on grants
+     * every origin listed here the right to make CREDENTIALED cross-origin calls and READ the
+     * responses, so an unnecessary entry here is pure attack surface.
+     *
+     * Set it in exactly two cases, where the browser really is on a different origin than the api:
+     * 1. LOCAL DEV — `ng serve` on :4200 calling an api on :8080. Use the wildcard port, because the
+     *    dev-server port moves: `config.corsOrigins = ['http://localhost:*'];`
+     * 2. A UI HOSTED ON A DIFFERENT HOST than the api (CDN / custom domain):
+     *    `config.corsOrigins = ['https://app.example.com'];`
+     *
+     * Matching is EXACT, with one exception: a `*` in the PORT position matches any port
+     * (`http://localhost:*`). It is not a general wildcard — it never spans a host, so
+     * `http://localhost:*` will not match `http://localhost.evil.com`, and a bare `*` matches
+     * nothing. The server's OWN origin is always allowed when cors is mounted (a browser sends
+     * `Origin` on every POST, even a same-origin one, so the middleware would otherwise 403 the
+     * server's own UI).
      */
     corsOrigins?: string[];
     /**

package/src/WebpiecesConfig.js

@@ -7,13 +7,26 @@ exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = void 0;
  */
 class WebpiecesConfig {
     /**
-     * EXTRA cross-origin origins to allow, beyond the two that are always allowed: the server's OWN
-     * origin (same-origin — a browser sends `Origin` on every POST, even same-origin, so this is what
-     * lets a server that also serves its own UI answer its own api calls) and `localhost:*` (dev).
+     * The browser origins allowed to call this api CROSS-ORIGIN. Empty/unset (the default) means
+     * CORS middleware is NEVER MOUNTED — leave it that way in production.
      *
-     * Only needed when the browser origin differs from the api origin AND is not localhost — e.g. a
-     * UI on a CDN/custom domain calling an api on a different host. Exact origin match, e.g.
-     * `['https://app.example.com']`.
+     * You almost never want this in production. A server that also serves its own browser app does
+     * NOT need cors: a browser applies no cors check to a same-origin request. Turning cors on grants
+     * every origin listed here the right to make CREDENTIALED cross-origin calls and READ the
+     * responses, so an unnecessary entry here is pure attack surface.
+     *
+     * Set it in exactly two cases, where the browser really is on a different origin than the api:
+     * 1. LOCAL DEV — `ng serve` on :4200 calling an api on :8080. Use the wildcard port, because the
+     *    dev-server port moves: `config.corsOrigins = ['http://localhost:*'];`
+     * 2. A UI HOSTED ON A DIFFERENT HOST than the api (CDN / custom domain):
+     *    `config.corsOrigins = ['https://app.example.com'];`
+     *
+     * Matching is EXACT, with one exception: a `*` in the PORT position matches any port
+     * (`http://localhost:*`). It is not a general wildcard — it never spans a host, so
+     * `http://localhost:*` will not match `http://localhost.evil.com`, and a bare `*` matches
+     * nothing. The server's OWN origin is always allowed when cors is mounted (a browser sends
+     * `Origin` on every POST, even a same-origin one, so the middleware would otherwise 403 the
+     * server's own UI).
      */
     corsOrigins;
     /**

package/src/WebpiecesConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebpiecesConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/WebpiecesConfig.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,MAAa,eAAe;IACxB;;;;;;;;OAQG;IACH,WAAW,CAAY;IAEvB;;;;OAIG;IACH,iBAAiB,CAAW;IAE5B;;;OAGG;IACH,YAAY,CAAU;CACzB;AAxBD,0CAwBC;AAED;;GAEG;AACU,QAAA,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC","sourcesContent":["/**\n * Configuration for WebPieces server.\n * Per CLAUDE.md: Data-only structure = class\n */\nexport class WebpiecesConfig {\n    /**\n     * EXTRA cross-origin origins to allow, beyond the two that are always allowed: the server's OWN\n     * origin (same-origin — a browser sends `Origin` on every POST, even same-origin, so this is what\n     * lets a server that also serves its own UI answer its own api calls) and `localhost:*` (dev).\n     *\n     * Only needed when the browser origin differs from the api origin AND is not localhost — e.g. a\n     * UI on a CDN/custom domain calling an api on a different host. Exact origin match, e.g.\n     * `['https://app.example.com']`.\n     */\n    corsOrigins?: string[];\n\n    /**\n     * Record EVERY request as a test case (fixture + generated spec), instead\n     * of only requests carrying the x-webpieces-recording header.\n     * Intended for tests/dev - do not leave on in production.\n     */\n    recordingAlwaysOn?: boolean;\n\n    /**\n     * Directory where recorded fixtures + generated specs are written.\n     * When unset, recordings are only logged.\n     */\n    recordingDir?: string;\n}\n\n/**\n * DI token for WebpiecesConfig injection.\n */\nexport const WEBPIECES_CONFIG_TOKEN = Symbol.for('WebpiecesConfig');\n"]}
+{"version":3,"file":"WebpiecesConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/WebpiecesConfig.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,MAAa,eAAe;IACxB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,WAAW,CAAY;IAEvB;;;;OAIG;IACH,iBAAiB,CAAW;IAE5B;;;OAGG;IACH,YAAY,CAAU;CACzB;AArCD,0CAqCC;AAED;;GAEG;AACU,QAAA,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC","sourcesContent":["/**\n * Configuration for WebPieces server.\n * Per CLAUDE.md: Data-only structure = class\n */\nexport class WebpiecesConfig {\n    /**\n     * The browser origins allowed to call this api CROSS-ORIGIN. Empty/unset (the default) means\n     * CORS middleware is NEVER MOUNTED — leave it that way in production.\n     *\n     * You almost never want this in production. A server that also serves its own browser app does\n     * NOT need cors: a browser applies no cors check to a same-origin request. Turning cors on grants\n     * every origin listed here the right to make CREDENTIALED cross-origin calls and READ the\n     * responses, so an unnecessary entry here is pure attack surface.\n     *\n     * Set it in exactly two cases, where the browser really is on a different origin than the api:\n     * 1. LOCAL DEV — `ng serve` on :4200 calling an api on :8080. Use the wildcard port, because the\n     *    dev-server port moves: `config.corsOrigins = ['http://localhost:*'];`\n     * 2. A UI HOSTED ON A DIFFERENT HOST than the api (CDN / custom domain):\n     *    `config.corsOrigins = ['https://app.example.com'];`\n     *\n     * Matching is EXACT, with one exception: a `*` in the PORT position matches any port\n     * (`http://localhost:*`). It is not a general wildcard — it never spans a host, so\n     * `http://localhost:*` will not match `http://localhost.evil.com`, and a bare `*` matches\n     * nothing. The server's OWN origin is always allowed when cors is mounted (a browser sends\n     * `Origin` on every POST, even a same-origin one, so the middleware would otherwise 403 the\n     * server's own UI).\n     */\n    corsOrigins?: string[];\n\n    /**\n     * Record EVERY request as a test case (fixture + generated spec), instead\n     * of only requests carrying the x-webpieces-recording header.\n     * Intended for tests/dev - do not leave on in production.\n     */\n    recordingAlwaysOn?: boolean;\n\n    /**\n     * Directory where recorded fixtures + generated specs are written.\n     * When unset, recordings are only logged.\n     */\n    recordingDir?: string;\n}\n\n/**\n * DI token for WebpiecesConfig injection.\n */\nexport const WEBPIECES_CONFIG_TOKEN = Symbol.for('WebpiecesConfig');\n"]}