braid-http 1.3.98 → 1.3.101

package/README.md

@@ -385,6 +385,23 @@ var braidify = require('braid-http').http-server
 nbraidify.enable_multiplex = true   // or false
 ```
 
+### How CORS works with Multiplexing
+
+When multiplexing is enabled, the library presents the illusion that
+everything is normal HTTP.  Behind the scenes, a request/response pair is
+made to `.well-known/multiplexer/<id>` to establish the multiplexer
+channel — CORS is opened on this request.  However, this request is hidden
+from client code (it happens inside `braid_fetch`) and the response is
+hidden from server code (it happens inside `braidify`).
+
+One might worry that a cross-origin GET without proper CORS could trick the
+server into piping its response through the multiplexer channel — and since
+CORS is opened on the multiplexer channel, the client could read data it
+shouldn't have access to.  This doesn't happen, because the browser sends a
+preflight OPTIONS request before the actual GET.  If the server doesn't
+return the proper CORS headers for that OPTIONS request, the browser never
+sends the GET, and no data flows through the multiplexer channel.
+
 ## Testing
 
 Run all tests from the command line:

package/braid-http-server.js

@@ -220,6 +220,43 @@ function parse_content_range (range_string) {
     return [unit, range]
 }
 
+
+// Guard against double-braidification.
+//
+// Libraries (like braid-text &braid-blob) call braidify on the same
+// request/response.  We can't let it run twice on the same request.  That can
+// cause e.g. duplicate multiplexer request-id errors (409).
+var braidify_version = require('./package.json').version
+var warned_about_braidify_dupe = false
+function warn_braidify_dupe (req) {
+    function version_bigger (a, b) {
+        var pa = a.split('.').map(Number)
+        var pb = b.split('.').map(Number)
+        for (var i = 0; i < Math.max(pa.length, pb.length); i++) {
+            if ((pa[i] || 0) > (pb[i] || 0)) return true
+            if ((pa[i] || 0) < (pb[i] || 0)) return false
+        }
+        return false
+    }
+
+    if (!warned_about_braidify_dupe) {
+        var installed = req._braidified
+        var major_mismatch = installed.split('.')[0] !== braidify_version.split('.')[0]
+        var dominated = version_bigger(braidify_version, installed)
+
+        if (major_mismatch || dominated)
+            console.warn('braid-http: braidify already applied (v' + installed
+                         + '), skipping v' + braidify_version
+                         + (major_mismatch
+                            ? ' — major version mismatch, things may break'
+                            : ' — installed version is older, may lack features'))
+
+        warned_about_braidify_dupe = true
+    }
+}
+
+
+// The main server function!
 function braidify (req, res, next) {
     if (typeof req === 'function') {
         var handler = req
@@ -227,6 +264,15 @@ function braidify (req, res, next) {
             braidify(req, res, () => handler(req, res, next))
     }
 
+
+    // Guard against double-braidification.
+    if (req._braidified) {
+        warn_braidify_dupe(req)
+        return next?.()
+    }
+
+    req._braidified = braidify_version
+
     // console.log('\n## Braidifying', req.method, req.url, req.headers.peer)
 
     // Prevent uncaught EPIPE crashes on client disconnect
@@ -349,6 +395,9 @@ function braidify (req, res, next) {
         // find the multiplexer object (contains a response object)
         var m = braidify.multiplexers?.get(multiplexer)
         if (!m) {
+            // free cors to multiplexer errors
+            free_cors(res)
+            
             req.is_multiplexer = res.is_multiplexer = true
             res.writeHead(424, 'Multiplexer no exist', {'Bad-Multiplexer': multiplexer})
             return res.end(`multiplexer ${multiplexer} does not exist`)
@@ -356,6 +405,9 @@ function braidify (req, res, next) {
 
         // if this request-id already exists, respond with an error
         if (m.requests.has(request)) {
+            // free cors to multiplexer errors
+            free_cors(res)
+
             req.is_multiplexer = res.is_multiplexer = true
             res.writeHead(409, 'Conflict', {'Content-Type': 'application/json'})
             return res.end(JSON.stringify({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "braid-http",
-  "version": "1.3.98",
+  "version": "1.3.101",
   "description": "An implementation of Braid-HTTP for Node.js and Browsers",
   "scripts": {
     "test": "node test/test.js",