socket-function 1.2.25 → 1.2.26

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "socket-function",
-	"version": "1.2.25",
+	"version": "1.2.26",
 	"main": "index.js",
 	"license": "MIT",
 	"dependencies": {

package/src/callHTTPHandler.ts

@@ -63,16 +63,29 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
     try {
         // Always set x-frame-options, to prevent iframe embedding click hijacking
         response.setHeader("X-Frame-Options", "SAMEORIGIN");
+        // Only frame-ancestors, as a full CSP would break our eval-based module loading
+        response.setHeader("Content-Security-Policy", "frame-ancestors 'self'");
+        response.setHeader("X-Content-Type-Options", "nosniff");
+        // Without this, the full URL (including classGuid/functionName/args in the query) leaks in the Referer to any third-party resource
+        response.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
         // Don't keep alive, to prevent issues with zombie sockets.
         response.setHeader("Connection", "close");
 
         // CORS bs (due to having to explictly allow subdomains)
+        let corsAllowed = false;
         {
             response.setHeader("Strict-Transport-Security", "max-age=63072000; includeSubDomains; preload");
             response.setHeader("Cross-Origin-Opener-Policy", SocketFunction.COOP);
             response.setHeader("Cross-Origin-Embedder-Policy", SocketFunction.COEP);
 
-            let origin = request.headers.origin || request.headers.referer;
+            let origin = request.headers.origin;
+            if (!origin && request.headers.referer) {
+                // Referer is a full URL, but Access-Control-Allow-Origin must be a bare origin
+                try {
+                    origin = new URL(request.headers.referer).origin;
+                } catch {
+                }
+            }
             let allowed = false;
             if (!origin) {
                 // I guess it's a script, so just allow it (as it could easily set any header it wanted anyways)
@@ -98,15 +111,28 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
                 response.setHeader("Cross-Origin-Resource-Policy", "same-site");
             }
 
-            response.setHeader("vary", "Access-Control-Request-Headers");
+            response.setHeader("Vary", "Origin, Access-Control-Request-Headers");
             response.setHeader("Access-Control-Allow-Origin", allowed ? origin : "");
 
-            if (allowed) {
+            // Browsers reject Allow-Credentials combined with a "*" origin, so don't emit that pair
+            if (allowed && origin !== "*") {
                 response.setHeader("Access-Control-Allow-Credentials", "true");
                 response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
                 response.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Content-Length, X-Requested-With, x-uncompressed-content-length, Cookie");
             }
             response.setHeader("Access-Control-Expose-Headers", "x-uncompressed-content-length");
+            corsAllowed = allowed;
+        }
+
+        // Preflights must never run the underlying call (they also arrive without credentials, so the call would be wrong anyways)
+        if (request.method === "OPTIONS") {
+            response.writeHead(204);
+            return;
+        }
+        // The browser discards the response for disallowed origins anyways, so running the call would only produce side effects the caller can't even see
+        if (!corsAllowed) {
+            response.writeHead(403);
+            return;
         }
 
 
@@ -235,6 +261,10 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
                 return;
             }
         }
+        // With nosniff set, an untyped response is unusable to the browser, so results without explicit headers need their actual type (JSON) declared
+        if (!response.getHeader("Content-Type")) {
+            response.setHeader("Content-Type", "application/json");
+        }
         let uncompressedLength = resultBuffer.length;
         if (SocketFunction.HTTP_COMPRESS && request.headers["accept-encoding"]?.includes("gzip") && !headers?.["Content-Encoding"]) {
             // NOTE: This is a BIT slow. To speed it up, functions can use an internal cache, according to their function,