middleware/cors: improve cors middleware.

bcoin-org · Dec 16, 2023 · ef968f5 · ef968f5
1 parent 3bb3462
commit ef968f5
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 13 deletions.
diff --git a/lib/middleware/cors.js b/lib/middleware/cors.js
@@ -6,27 +6,46 @@
 
 'use strict';
 
+const assert = require('bsert');
+
 /**
  * CORS middleware.
  * @returns {Function}
  */
 
-function cors() {
+function cors(options = {}) {
+  assert(options && typeof options === 'object');
+  assert(options.origins == null || Array.isArray(options.origins));
+
+  const origins = options.origins || [];
+
+  for (const origin of origins) {
+    assert(typeof origin === 'string' && origin.length > 0);
+    assert(origin !== '*' && origin !== 'null');
+  }
+
   return async (req, res) => {
-    const origin = req.headers.origin != null
-      ? req.headers.origin
-      : '*';
+    const origin = req.headers.origin || '';
 
-    res.setHeader('Access-Control-Allow-Origin', origin);
     res.setHeader('Access-Control-Allow-Credentials', 'true');
-    res.setHeader(
-      'Access-Control-Allow-Methods',
-      'GET,HEAD,PUT,PATCH,POST,DELETE');
-    res.setHeader(
-      'Access-Control-Allow-Headers', 'Authorization,Content-Type,User-Agent');
 
     if (req.method === 'OPTIONS') {
-      res.setStatus(200);
+      res.setHeader('Access-Control-Allow-Headers',
+                    'Authorization,Content-Type,User-Agent');
+      res.setHeader('Access-Control-Allow-Methods',
+                    'GET,HEAD,PUT,PATCH,POST,DELETE');
+    }
+
+    if (origins.length === 0)
+      res.setHeader('Access-Control-Allow-Origin', origin || '*');
+    else if (origins.length === 1)
+      res.setHeader('Access-Control-Allow-Origin', origins[0]);
+    else if (origins.includes(origin))
+      res.setHeader('Access-Control-Allow-Origin', origin);
+
+    if (req.method === 'OPTIONS') {
+      res.setHeader('Content-Length', '0');
+      res.setStatus(204);
       res.end();
       return;
     }

diff --git a/lib/server.js b/lib/server.js
@@ -620,11 +620,12 @@ class Server extends EventEmitter {
 
   /**
    * CORS middleware.
+   * @param {Object} options
    * @returns {Function}
    */
 
-  cors() {
-    return middleware.cors();
+  cors(options) {
+    return middleware.cors(options);
   }
 
   /**
@@ -650,6 +651,7 @@ class Server extends EventEmitter {
   /**
    * JSON rpc middleware.
    * @param {Object} rpc
+   * @param {Object} options
    * @returns {Function}
    */