@zimic/interceptor 1.5.0 → 1.5.1

package/dist/server.js

@@ -1,29 +1,29 @@
 'use strict';
 
-var chunk3W3A4TJ5_js = require('./chunk-3W3A4TJ5.js');
+var chunk3WCEMV5U_js = require('./chunk-3WCEMV5U.js');
 require('./chunk-DGUM43GV.js');
 
 
 
 Object.defineProperty(exports, "DEFAULT_ACCESS_CONTROL_HEADERS", {
   enumerable: true,
-  get: function () { return chunk3W3A4TJ5_js.DEFAULT_ACCESS_CONTROL_HEADERS; }
+  get: function () { return chunk3WCEMV5U_js.DEFAULT_ACCESS_CONTROL_HEADERS; }
 });
 Object.defineProperty(exports, "DEFAULT_PREFLIGHT_STATUS_CODE", {
   enumerable: true,
-  get: function () { return chunk3W3A4TJ5_js.DEFAULT_PREFLIGHT_STATUS_CODE; }
+  get: function () { return chunk3WCEMV5U_js.DEFAULT_PREFLIGHT_STATUS_CODE; }
 });
 Object.defineProperty(exports, "NotRunningInterceptorServerError", {
   enumerable: true,
-  get: function () { return chunk3W3A4TJ5_js.NotRunningInterceptorServerError_default; }
+  get: function () { return chunk3WCEMV5U_js.NotRunningInterceptorServerError_default; }
 });
 Object.defineProperty(exports, "RunningInterceptorServerError", {
   enumerable: true,
-  get: function () { return chunk3W3A4TJ5_js.RunningInterceptorServerError_default; }
+  get: function () { return chunk3WCEMV5U_js.RunningInterceptorServerError_default; }
 });
 Object.defineProperty(exports, "createInterceptorServer", {
   enumerable: true,
-  get: function () { return chunk3W3A4TJ5_js.createInterceptorServer; }
+  get: function () { return chunk3WCEMV5U_js.createInterceptorServer; }
 });
 //# sourceMappingURL=server.js.map
 //# sourceMappingURL=server.js.map

package/dist/server.mjs

@@ -1,4 +1,4 @@
-export { DEFAULT_ACCESS_CONTROL_HEADERS, DEFAULT_PREFLIGHT_STATUS_CODE, NotRunningInterceptorServerError_default as NotRunningInterceptorServerError, RunningInterceptorServerError_default as RunningInterceptorServerError, createInterceptorServer } from './chunk-F3VMDYHM.mjs';
+export { DEFAULT_ACCESS_CONTROL_HEADERS, DEFAULT_PREFLIGHT_STATUS_CODE, NotRunningInterceptorServerError_default as NotRunningInterceptorServerError, RunningInterceptorServerError_default as RunningInterceptorServerError, createInterceptorServer } from './chunk-YQNDAJTN.mjs';
 import './chunk-BJTO5JO5.mjs';
 //# sourceMappingURL=server.mjs.map
 //# sourceMappingURL=server.mjs.map

package/package.json

@@ -14,7 +14,7 @@
     "api",
     "static"
   ],
-  "version": "1.5.0",
+  "version": "1.5.1",
   "homepage": "https://zimic.dev/docs/interceptor",
   "repository": {
     "type": "git",
@@ -100,12 +100,12 @@
     "isomorphic-ws": "5.0.0",
     "msw": "2.15.0",
     "picocolors": "^1.1.1",
-    "ws": "8.21.0",
-    "yargs": "18.0.0",
+    "ws": "8.21.1",
+    "yargs": "18.1.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.1.2",
     "@types/ws": "^8.18.1",
     "@types/yargs": "^17.0.35",
     "@typescript/native": "npm:typescript@^7.0.2",
@@ -116,10 +116,10 @@
     "@zimic/lint-staged-config": "workspace:*",
     "@zimic/tsconfig": "workspace:*",
     "@zimic/utils": "workspace:*",
-    "concurrently": "^10.0.3",
+    "concurrently": "^10.0.4",
     "dotenv-cli": "^11.0.0",
-    "eslint": "^9.39.4",
-    "playwright": "^1.61.1",
+    "eslint": "^9.39.5",
+    "playwright": "^1.62.0",
     "tsup": "^8.5.1",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vitest": "^4.1.10"

package/src/cli/cli.ts

@@ -79,9 +79,9 @@ async function runCLI() {
                 type: 'string',
                 description:
                   'The directory where the authorized interceptor authentication tokens are saved. If provided, only ' +
-                  'remote interceptors bearing a valid token will be accepted. This option is essential if you are ' +
-                  'exposing your interceptor server publicly. For local development and testing, though, ' +
-                  '`--tokens-dir` is optional.',
+                  'remote interceptors bearing a valid token will be accepted. While authentication is optional for ' +
+                  'private development servers, it is strongly recommended when the server is not bound to localhost, ' +
+                  '127.0.0.1, or ::1, or when it is shared over a network.',
                 alias: 't',
               }),
           async (cliArguments) => {

package/src/cli/server/start.ts

@@ -42,6 +42,7 @@ async function startInterceptorServer({
     }
 
     const exitCode = exitEvent ? PROCESS_EXIT_CODE_BY_EXIT_EVENT[exitEvent] : undefined;
+
     if (exitCode !== undefined) {
       process.exit(exitCode);
     }
@@ -64,18 +65,6 @@ async function startInterceptorServer({
     `${ephemeral ? 'Ephemeral s' : 'S'}erver is running on ${color.yellow(`${server.hostname}:${server.port}`)}`,
   );
 
-  const isDangerouslyUnprotected = !tokensDirectory && process.env.NODE_ENV === 'production';
-
-  if (isDangerouslyUnprotected) {
-    logger.warn(
-      [
-        `Attention: this interceptor server is ${color.bold(color.red('unprotected'))}. Do not expose it publicly without authentication.`,
-        '',
-        'Learn more: https://zimic.dev/docs/interceptor/guides/http/remote-interceptors#interceptor-server-authentication',
-      ].join('\n'),
-    );
-  }
-
   if (onReady) {
     try {
       await runCommand(onReady.command, onReady.arguments);

package/src/http/interceptor/HttpInterceptorImplementation.ts

@@ -90,8 +90,7 @@ class HttpInterceptorImplementation<
     };
 
     this.onUnhandledRequest = options.onUnhandledRequest satisfies
-      | UnhandledRequestStrategy
-      | undefined as this['onUnhandledRequest'];
+      UnhandledRequestStrategy | undefined as this['onUnhandledRequest'];
 
     this.Handler = options.Handler;
   }

package/src/http/interceptorWorker/HttpInterceptorWorker.ts

@@ -249,8 +249,7 @@ abstract class HttpInterceptorWorker {
   createResponseFromDeclaration(
     request: HttpRequest,
     declaration:
-      | { status: number; headers?: HttpHeadersInit; body?: HttpBody }
-      | { action: UnhandledRequestStrategy.Action },
+      { status: number; headers?: HttpHeadersInit; body?: HttpBody } | { action: UnhandledRequestStrategy.Action },
   ): PossiblePromise<HttpResponse | null> {
     if ('action' in declaration) {
       if (declaration.action === 'bypass') {

package/src/http/interceptorWorker/LocalHttpInterceptorWorker.ts

@@ -252,8 +252,7 @@ class LocalHttpInterceptorWorker extends HttpInterceptorWorker {
   async createResponseFromDeclaration(
     request: HttpRequest,
     declaration:
-      | { status: number; headers?: HttpHeadersInit; body?: HttpBody }
-      | { action: UnhandledRequestStrategy.Action },
+      { status: number; headers?: HttpHeadersInit; body?: HttpBody } | { action: UnhandledRequestStrategy.Action },
   ) {
     const requestClone = request.clone();
     const response = await super.createResponseFromDeclaration(request, declaration);

package/src/http/interceptorWorker/RemoteHttpInterceptorWorker.ts

@@ -171,8 +171,7 @@ class RemoteHttpInterceptorWorker extends HttpInterceptorWorker {
   async createResponseFromDeclaration(
     request: HttpRequest,
     declaration:
-      | { status: number; headers?: HttpHeadersInit; body?: HttpBody }
-      | { action: UnhandledRequestStrategy.Action },
+      { status: number; headers?: HttpHeadersInit; body?: HttpBody } | { action: UnhandledRequestStrategy.Action },
   ) {
     const response = await super.createResponseFromDeclaration(request, declaration);
 

package/src/server/InterceptorServer.ts

@@ -4,10 +4,13 @@ import { startHttpServer, stopHttpServer, getHttpServerPort } from '@zimic/utils
 import { createRegexFromPath, excludeNonPathParams } from '@zimic/utils/url';
 import { createServer, Server as HttpServer, IncomingMessage, ServerResponse } from 'http';
 import type { WebSocket as Socket } from 'isomorphic-ws';
+import color from 'picocolors';
 
 import HttpInterceptorWorker from '@/http/interceptorWorker/HttpInterceptorWorker';
 import { removeArrayIndex } from '@/utils/arrays';
 import { deserializeResponse, SerializedHttpRequest, serializeRequest } from '@/utils/fetch';
+import { isLoopbackHostname } from '@/utils/http';
+import { logger } from '@/utils/logging';
 import { WebSocketMessageAbortError } from '@/utils/webSocket';
 import { WebSocketEventMessage } from '@/utils/webSocket/types';
 import WebSocketServer, { WebSocketServerAuthenticate } from '@/utils/webSocket/WebSocketServer';
@@ -124,11 +127,58 @@ class InterceptorServer implements PublicInterceptorServer {
     });
 
     this.startWebSocketServer();
+
+    const isDangerouslyUnprotected =
+      !this.tokensDirectory && (process.env.NODE_ENV === 'production' || !isLoopbackHostname(this.hostname));
+
+    if (isDangerouslyUnprotected) {
+      logger.warn(
+        [
+          `Attention: this interceptor server is ${color.bold(
+            color.red('unprotected'),
+          )}. Do not expose it publicly without authentication.`,
+          '',
+          'For your safety, this server will reject remote browser interceptors until authentication is configured.',
+          '',
+          'In @zimic/interceptor v2, interceptor servers running on non-loopback hostnames will require ' +
+            'authentication and refuse to start without a tokens directory.',
+          '',
+          'Learn more: https://zimic.dev/docs/interceptor/guides/http/remote-interceptors#interceptor-server-authentication',
+        ].join('\n'),
+      );
+    }
   }
 
   private authenticateWebSocketConnection: WebSocketServerAuthenticate = async (_socket, request) => {
     if (!this.tokensDirectory) {
-      return { isValid: true };
+      // Requests without an origin header are allowed when the interceptor server is not configured to require token
+      // authentication. They are typically made by non-browser clients.
+      if (request.headers.origin === undefined) {
+        return { isValid: true };
+      }
+
+      try {
+        const originURL = new URL(request.headers.origin);
+        const originHostname = originURL.hostname === '[::1]' ? '::1' : originURL.hostname;
+
+        const originMatchesServerLoopback =
+          originURL.origin === request.headers.origin &&
+          isLoopbackHostname(this.hostname) &&
+          isLoopbackHostname(originHostname);
+
+        if (originMatchesServerLoopback) {
+          return { isValid: true };
+        }
+      } catch (error) {
+        console.error(error);
+      }
+
+      return {
+        isValid: false,
+        message:
+          'Unauthenticated browser connections are only allowed from loopback origins. ' +
+          'Configure token authentication.',
+      };
     }
 
     const tokenValue = this.getWebSocketRequestTokenValue(request);

package/src/utils/http.ts

@@ -14,3 +14,9 @@ export const HTTP_METHODS_WITH_RESPONSE_BODY = new Set<HttpMethod>([
 export function methodCanHaveResponseBody(method: HttpMethod) {
   return HTTP_METHODS_WITH_RESPONSE_BODY.has(method);
 }
+
+export const LOOPBACK_HOSTNAMES = Object.freeze(['localhost', '127.0.0.1', '::1']);
+
+export function isLoopbackHostname(hostname: string) {
+  return LOOPBACK_HOSTNAMES.includes(hostname.toLowerCase());
+}

package/src/utils/webSocket/types.ts

@@ -58,5 +58,4 @@ export type WebSocketReplyMessageListener<Schema extends WebSocketSchema, Channe
 ) => PossiblePromise<void>;
 
 export type WebSocketMessageListener<Schema extends WebSocketSchema, Channel extends WebSocketChannel<Schema>> =
-  | WebSocketEventMessageListener<Schema, Channel>
-  | WebSocketReplyMessageListener<Schema, Channel>;
+  WebSocketEventMessageListener<Schema, Channel> | WebSocketReplyMessageListener<Schema, Channel>;