Nose Picking Mechanisms

    @skazka/server-cors

    0.0.9 • Public • Published

    Server cors

    Skazka Server Cross-Origin Resource Sharing (CORS).

    NPM

    How to install

    npm i @skazka/server @skazka/server-cors
    

    With yarn:

    yarn add @skazka/server @skazka/server-cors
    

    Optionally you can add http server, error handler, logger, router, request and response:

    npm i @skazka/server-http @skazka/server-router @skazka/server-error @skazka/server-logger @skazka/server-request @skazka/server-response
    

    With yarn:

    yarn add @skazka/server-http @skazka/server-router @skazka/server-error @skazka/server-logger @skazka/server-request @skazka/server-response
    

    How to use

    Server module

    const App = require('@skazka/server');
    const Router = require('@skazka/server-router');
            
    const cors = require('@skazka/server-cors');
            
    const error = require('@skazka/server-error');
    const logger = require('@skazka/server-logger');
    
    const request = require('@skazka/server-request');
    const response = require('@skazka/server-response');
            
    const server = require('@skazka/server-http');
            
    const app = new App();
    const router = new Router();
            
    app.all([
      error(),
      logger(),
      request(),
      cors(),
      response(),
    ]);
        
    router.get('/data').then(async (ctx) => {
      return ctx.response('data'); 
    });
            
    app.then(router.resolve());
            
    server.createHttpServer(app);

    Configuring CORS

    const corsOptions = {
      origin: 'http://example.com',
      optionsSuccessStatus: 200 // some legacy browsers (IE11, various SmartTVs) choke on 204
    }
    
    app.then(cors(corsOptions)); //This is CORS-enabled for only example.com.

    If you do not want to block REST tools or server-to-server requests, add a !origin check in the origin function like so:

    var corsOptions = {
      origin(origin, callback) {
        if (whitelist.indexOf(origin) !== -1 || !origin) {
          callback(null, true)
        } else {
          callback(new Error('Not allowed by CORS'))
        }
      }
    }

    Enabling CORS Pre-Flight

    const app = new App();
    app.all([
      error(),
      logger(),
      response(),
    ]);
        
    router.get('/data').then(async (ctx) => {
      await cors();
      return ctx.response('data'); 
    });
            
    app.then(router.resolve());
            
    server.createHttpServer(app);

    Configuration Options

    • origin: Configures the Access-Control-Allow-Origin CORS header. Possible values:
      • Boolean - set origin to true to reflect the request origin, as defined by req.header('Origin'), or set it to false to disable CORS.
      • String - set origin to a specific origin. For example if you set it to "http://example.com" only requests from "http://example.com" will be allowed.
      • RegExp - set origin to a regular expression pattern which will be used to test the request origin. If it's a match, the request origin will be reflected. For example the pattern /example\.com$/ will reflect any request that is coming from an origin ending with "example.com".
      • Array - set origin to an array of valid origins. Each origin can be a String or a RegExp. For example ["http://example1.com", /\.example2\.com$/] will accept any request from "http://example1.com" or from a subdomain of "example2.com".
      • Function - set origin to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (which expects the signature err [object], allow [bool]) as the second.
    • methods: Configures the Access-Control-Allow-Methods CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: ['GET', 'PUT', 'POST']).
    • allowedHeaders: Configures the Access-Control-Allow-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: ['Content-Type', 'Authorization']). If not specified, defaults to reflecting the headers specified in the request's Access-Control-Request-Headers header.
    • exposedHeaders: Configures the Access-Control-Expose-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Range,X-Content-Range') or an array (ex: ['Content-Range', 'X-Content-Range']). If not specified, no custom headers are exposed.
    • credentials: Configures the Access-Control-Allow-Credentials CORS header. Set to true to pass the header, otherwise it is omitted.
    • maxAge: Configures the Access-Control-Max-Age CORS header. Set to an integer to pass the header, otherwise it is omitted.
    • preflightContinue: Pass the CORS preflight response to the next handler.
    • optionsSuccessStatus: Provides a status code to use for successful OPTIONS requests, since some legacy browsers (IE11, various SmartTVs) choke on 204.

    The default configuration is the equivalent of:

    {
      "origin": "*",
      "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
      "preflightContinue": false,
      "optionsSuccessStatus": 204
    }

    For details on the effect of each CORS header, read this article on HTML5 Rocks.

    Install

    npm i @skazka/server-cors

    DownloadsWeekly Downloads

    1

    Version

    0.0.9

    License

    MIT

    Unpacked Size

    6.65 kB

    Total Files

    3

    Last publish

    Collaborators

    • evheniy.bystrov
    • skazkajs