bxo 0.0.5-dev.41 → 0.0.5-dev.42
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/plugins/cors.ts +2 -59
package/package.json
CHANGED
package/plugins/cors.ts
CHANGED
|
@@ -60,67 +60,10 @@ export function cors(options: CORSOptions = {}): any {
|
|
|
60
60
|
return {
|
|
61
61
|
name: 'cors',
|
|
62
62
|
onRequest: async (ctx: any) => {
|
|
63
|
-
// Handle preflight OPTIONS request
|
|
64
|
-
if (ctx.request.method === 'OPTIONS') {
|
|
65
|
-
const headers: Record<string, string> = {};
|
|
66
|
-
|
|
67
|
-
// Get and validate origin
|
|
68
|
-
const requestOrigin = getRequestOrigin(ctx.request);
|
|
69
|
-
const validatedOrigin = validateOrigin(requestOrigin, origin);
|
|
70
|
-
|
|
71
|
-
if (validatedOrigin) {
|
|
72
|
-
headers['Access-Control-Allow-Origin'] = validatedOrigin;
|
|
73
|
-
} else if (typeof origin === 'string' && origin === '*') {
|
|
74
|
-
headers['Access-Control-Allow-Origin'] = '*';
|
|
75
|
-
}
|
|
76
|
-
|
|
77
|
-
headers['Access-Control-Allow-Methods'] = methods.join(', ');
|
|
78
|
-
headers['Access-Control-Allow-Headers'] = allowedHeaders.join(', ');
|
|
79
|
-
|
|
80
|
-
if (credentials) {
|
|
81
|
-
headers['Access-Control-Allow-Credentials'] = 'true';
|
|
82
|
-
}
|
|
83
|
-
|
|
84
|
-
headers['Access-Control-Max-Age'] = maxAge.toString();
|
|
85
|
-
|
|
86
|
-
ctx.set.status = 204;
|
|
87
|
-
ctx.set.headers = { ...ctx.set.headers, ...headers };
|
|
88
|
-
|
|
89
|
-
throw new Response(null, { status: 204, headers });
|
|
90
|
-
}
|
|
91
63
|
},
|
|
92
64
|
onResponse: async (ctx: any, response: any) => {
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
// Get and validate origin for actual requests
|
|
96
|
-
const requestOrigin = getRequestOrigin(ctx.request);
|
|
97
|
-
const validatedOrigin = validateOrigin(requestOrigin, origin);
|
|
98
|
-
|
|
99
|
-
if (validatedOrigin) {
|
|
100
|
-
headers['Access-Control-Allow-Origin'] = validatedOrigin;
|
|
101
|
-
} else if (typeof origin === 'string' && origin === '*') {
|
|
102
|
-
headers['Access-Control-Allow-Origin'] = '*';
|
|
103
|
-
}
|
|
104
|
-
|
|
105
|
-
if (credentials) {
|
|
106
|
-
headers['Access-Control-Allow-Credentials'] = 'true';
|
|
107
|
-
}
|
|
108
|
-
|
|
109
|
-
// If response is a Response object, add headers to it
|
|
110
|
-
if (response instanceof Response) {
|
|
111
|
-
const newHeaders = new Headers(response.headers);
|
|
112
|
-
Object.entries(headers).forEach(([key, value]) => {
|
|
113
|
-
newHeaders.set(key, value);
|
|
114
|
-
});
|
|
115
|
-
return new Response(response.body, {
|
|
116
|
-
status: response.status,
|
|
117
|
-
statusText: response.statusText,
|
|
118
|
-
headers: newHeaders
|
|
119
|
-
});
|
|
120
|
-
}
|
|
121
|
-
|
|
122
|
-
// Otherwise, set headers in context for the framework to handle
|
|
123
|
-
ctx.set.headers = { ...ctx.set.headers, ...headers };
|
|
65
|
+
response.headers.set('Access-Control-Allow-Origin', '*');
|
|
66
|
+
response.headers.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
|
|
124
67
|
return response;
|
|
125
68
|
}
|
|
126
69
|
};
|