socket-function 1.2.24 → 1.2.26

package/index.d.ts

@@ -991,11 +991,12 @@ declare module "socket-function/src/forwardPort" {
     export declare function listPortMappings(): Promise<PortMapping[]>;
     /** Outcome of forwardPort. `owned` is true once we hold the router mapping for the port. When
      *      false, `reason` says why: "declined" = noPortStealing and another host holds the port (the
-     *      caller should try a different port); "error" = UPnP unreachable / create failed (best-effort,
-     *      nothing forwarded but the caller can carry on). */
+     *      caller should try a different port); "notBehindNat" = we have a public/directly-reachable
+     *      address so there's nothing to forward; "error" = UPnP unreachable / create failed (best-effort,
+     *      nothing forwarded but the caller can carry on). Only "declined" warrants trying another port. */
     export type ForwardPortResult = {
         owned: boolean;
-        reason?: "declined" | "error";
+        reason?: "declined" | "notBehindNat" | "error";
     };
     export declare function forwardPort(config: {
         externalPort: number;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "socket-function",
-	"version": "1.2.24",
+	"version": "1.2.26",
 	"main": "index.js",
 	"license": "MIT",
 	"dependencies": {

package/src/callHTTPHandler.ts

@@ -63,16 +63,29 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
     try {
         // Always set x-frame-options, to prevent iframe embedding click hijacking
         response.setHeader("X-Frame-Options", "SAMEORIGIN");
+        // Only frame-ancestors, as a full CSP would break our eval-based module loading
+        response.setHeader("Content-Security-Policy", "frame-ancestors 'self'");
+        response.setHeader("X-Content-Type-Options", "nosniff");
+        // Without this, the full URL (including classGuid/functionName/args in the query) leaks in the Referer to any third-party resource
+        response.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
         // Don't keep alive, to prevent issues with zombie sockets.
         response.setHeader("Connection", "close");
 
         // CORS bs (due to having to explictly allow subdomains)
+        let corsAllowed = false;
         {
             response.setHeader("Strict-Transport-Security", "max-age=63072000; includeSubDomains; preload");
             response.setHeader("Cross-Origin-Opener-Policy", SocketFunction.COOP);
             response.setHeader("Cross-Origin-Embedder-Policy", SocketFunction.COEP);
 
-            let origin = request.headers.origin || request.headers.referer;
+            let origin = request.headers.origin;
+            if (!origin && request.headers.referer) {
+                // Referer is a full URL, but Access-Control-Allow-Origin must be a bare origin
+                try {
+                    origin = new URL(request.headers.referer).origin;
+                } catch {
+                }
+            }
             let allowed = false;
             if (!origin) {
                 // I guess it's a script, so just allow it (as it could easily set any header it wanted anyways)
@@ -98,15 +111,28 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
                 response.setHeader("Cross-Origin-Resource-Policy", "same-site");
             }
 
-            response.setHeader("vary", "Access-Control-Request-Headers");
+            response.setHeader("Vary", "Origin, Access-Control-Request-Headers");
             response.setHeader("Access-Control-Allow-Origin", allowed ? origin : "");
 
-            if (allowed) {
+            // Browsers reject Allow-Credentials combined with a "*" origin, so don't emit that pair
+            if (allowed && origin !== "*") {
                 response.setHeader("Access-Control-Allow-Credentials", "true");
                 response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
                 response.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Content-Length, X-Requested-With, x-uncompressed-content-length, Cookie");
             }
             response.setHeader("Access-Control-Expose-Headers", "x-uncompressed-content-length");
+            corsAllowed = allowed;
+        }
+
+        // Preflights must never run the underlying call (they also arrive without credentials, so the call would be wrong anyways)
+        if (request.method === "OPTIONS") {
+            response.writeHead(204);
+            return;
+        }
+        // The browser discards the response for disallowed origins anyways, so running the call would only produce side effects the caller can't even see
+        if (!corsAllowed) {
+            response.writeHead(403);
+            return;
         }
 
 
@@ -235,6 +261,10 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
                 return;
             }
         }
+        // With nosniff set, an untyped response is unusable to the browser, so results without explicit headers need their actual type (JSON) declared
+        if (!response.getHeader("Content-Type")) {
+            response.setHeader("Content-Type", "application/json");
+        }
         let uncompressedLength = resultBuffer.length;
         if (SocketFunction.HTTP_COMPRESS && request.headers["accept-encoding"]?.includes("gzip") && !headers?.["Content-Encoding"]) {
             // NOTE: This is a BIT slow. To speed it up, functions can use an internal cache, according to their function,

package/src/forwardPort.d.ts

@@ -26,11 +26,12 @@ export interface PortMapping {
 export declare function listPortMappings(): Promise<PortMapping[]>;
 /** Outcome of forwardPort. `owned` is true once we hold the router mapping for the port. When
  *      false, `reason` says why: "declined" = noPortStealing and another host holds the port (the
- *      caller should try a different port); "error" = UPnP unreachable / create failed (best-effort,
- *      nothing forwarded but the caller can carry on). */
+ *      caller should try a different port); "notBehindNat" = we have a public/directly-reachable
+ *      address so there's nothing to forward; "error" = UPnP unreachable / create failed (best-effort,
+ *      nothing forwarded but the caller can carry on). Only "declined" warrants trying another port. */
 export type ForwardPortResult = {
     owned: boolean;
-    reason?: "declined" | "error";
+    reason?: "declined" | "notBehindNat" | "error";
 };
 export declare function forwardPort(config: {
     externalPort: number;

package/src/forwardPort.ts

@@ -18,6 +18,13 @@ export async function resolveGateway(): Promise<{
     let internalIP = await getOutboundIP();
     if (!internalIP) throw new Error("Could not determine our local network address");
 
+    // A public/directly-reachable outbound address means there's no NAT and therefore no UPnP
+    //  gateway to reach — SSDP would just multicast into the void and time out after 2s. Fail fast
+    //  and clearly instead, so callers (and forwardPort) never spend that time on a public host.
+    if (!isPrivateIPv4(internalIP)) {
+        throw new Error(`Not behind a NAT (outbound address ${internalIP} is public) — no UPnP gateway to reach, skipping SSDP discovery.`);
+    }
+
     // The gateway that answers SSDP discovery is the router we forward through; take its IP
     //  and control port straight from the discovered device URL rather than parsing routes.
     let gateway = await discoverGateway(internalIP);
@@ -89,11 +96,12 @@ const SUPERSEDE_CHECK_INTERVAL = timeInMinute * 30;
 
 /** Outcome of forwardPort. `owned` is true once we hold the router mapping for the port. When
  *      false, `reason` says why: "declined" = noPortStealing and another host holds the port (the
- *      caller should try a different port); "error" = UPnP unreachable / create failed (best-effort,
- *      nothing forwarded but the caller can carry on). */
+ *      caller should try a different port); "notBehindNat" = we have a public/directly-reachable
+ *      address so there's nothing to forward; "error" = UPnP unreachable / create failed (best-effort,
+ *      nothing forwarded but the caller can carry on). Only "declined" warrants trying another port. */
 export type ForwardPortResult = {
     owned: boolean;
-    reason?: "declined" | "error";
+    reason?: "declined" | "notBehindNat" | "error";
 };
 
 export async function forwardPort(config: {
@@ -113,6 +121,12 @@ export async function forwardPort(config: {
     let duration = config.duration ?? PERMANENT_LEASE;
     let permanent = duration === PERMANENT_LEASE;
 
+    // Forwarding only makes sense behind a NAT. On a directly-reachable public host there's no
+    //  gateway, so skip UPnP entirely (no SSDP) rather than discovering-and-timing-out.
+    if (!await isBehindNAT()) {
+        return { owned: false, reason: "notBehindNat" };
+    }
+
     // Take ownership of the router's mapping for this external port: delete whatever's there (a
     //  stale mapping of ours, or another host's) so our AddPortMapping isn't rejected as a conflict
     //  (718), then install our mapping. This makes the last writer win — whichever application