bxo 0.0.5-dev.39 → 0.0.5-dev.40

package/README.md

@@ -221,6 +221,13 @@ app.use(cors({
 }));
 ```
 
+**Features:**
+- **Origin Header Support**: Standard CORS origin header handling
+- **Referer Header Fallback**: Automatically falls back to Referer header when Origin is not present
+- **Origin Precedence**: When both Origin and Referer are present, Origin takes precedence
+- **Invalid URL Handling**: Gracefully handles invalid Referer URLs
+- **Flexible Origin Configuration**: Supports string, array, boolean, or wildcard (`*`) origins
+
 #### Logger Plugin
 
 ```typescript

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bxo",
   "module": "index.ts",
-  "version": "0.0.5-dev.39",
+  "version": "0.0.5-dev.40",
   "description": "A simple and lightweight web framework for Bun",
   "type": "module",
   "devDependencies": {

package/plugins/cors.ts

@@ -8,6 +8,46 @@ interface CORSOptions {
   maxAge?: number;
 }
 
+// Helper function to extract origin from request headers
+function getRequestOrigin(request: Request): string | null {
+  // Try Origin header first (standard for CORS)
+  const origin = request.headers.get('origin');
+  if (origin) {
+    return origin;
+  }
+
+  // Fallback to Referer header
+  const referer = request.headers.get('referer');
+  if (referer) {
+    try {
+      const url = new URL(referer);
+      return `${url.protocol}//${url.host}`;
+    } catch (e) {
+      // Invalid referer URL, ignore it
+      return null;
+    }
+  }
+
+  return null;
+}
+
+// Helper function to validate origin against allowed origins
+function validateOrigin(requestOrigin: string | null, allowedOrigins: string | string[] | boolean): string | null {
+  if (!requestOrigin) {
+    return null;
+  }
+
+  if (typeof allowedOrigins === 'boolean') {
+    return allowedOrigins ? requestOrigin : null;
+  } else if (typeof allowedOrigins === 'string') {
+    return allowedOrigins === '*' || allowedOrigins === requestOrigin ? requestOrigin : null;
+  } else if (Array.isArray(allowedOrigins)) {
+    return allowedOrigins.includes(requestOrigin) ? requestOrigin : null;
+  }
+
+  return null;
+}
+
 export function cors(options: CORSOptions = {}): any {
   const {
     origin = '*',
@@ -24,18 +64,14 @@ export function cors(options: CORSOptions = {}): any {
       if (ctx.request.method === 'OPTIONS') {
         const headers: Record<string, string> = {};
 
-        // Handle origin
-        if (typeof origin === 'boolean') {
-          if (origin) {
-            headers['Access-Control-Allow-Origin'] = ctx.request.headers.get('origin') || '*';
-          }
-        } else if (typeof origin === 'string') {
-          headers['Access-Control-Allow-Origin'] = origin;
-        } else if (Array.isArray(origin)) {
-          const requestOrigin = ctx.request.headers.get('origin');
-          if (requestOrigin && origin.includes(requestOrigin)) {
-            headers['Access-Control-Allow-Origin'] = requestOrigin;
-          }
+        // Get and validate origin
+        const requestOrigin = getRequestOrigin(ctx.request);
+        const validatedOrigin = validateOrigin(requestOrigin, origin);
+
+        if (validatedOrigin) {
+          headers['Access-Control-Allow-Origin'] = validatedOrigin;
+        } else if (typeof origin === 'string' && origin === '*') {
+          headers['Access-Control-Allow-Origin'] = '*';
         }
 
         headers['Access-Control-Allow-Methods'] = methods.join(', ');
@@ -56,18 +92,14 @@ export function cors(options: CORSOptions = {}): any {
     onResponse: async (ctx: any, response: any) => {
       const headers: Record<string, string> = {};
 
-      // Handle origin for actual requests
-      if (typeof origin === 'boolean') {
-        if (origin) {
-          headers['Access-Control-Allow-Origin'] = ctx.request.headers.get('origin') || '*';
-        }
-      } else if (typeof origin === 'string') {
-        headers['Access-Control-Allow-Origin'] = origin;
-      } else if (Array.isArray(origin)) {
-        const requestOrigin = ctx.request.headers.get('origin');
-        if (requestOrigin && origin.includes(requestOrigin)) {
-          headers['Access-Control-Allow-Origin'] = requestOrigin;
-        }
+      // Get and validate origin for actual requests
+      const requestOrigin = getRequestOrigin(ctx.request);
+      const validatedOrigin = validateOrigin(requestOrigin, origin);
+
+      if (validatedOrigin) {
+        headers['Access-Control-Allow-Origin'] = validatedOrigin;
+      } else if (typeof origin === 'string' && origin === '*') {
+        headers['Access-Control-Allow-Origin'] = '*';
       }
 
       if (credentials) {