57 lines
1.9 KiB
JavaScript
57 lines
1.9 KiB
JavaScript
/* jshint node:true */
|
|
|
|
'use strict';
|
|
|
|
var url = require('url');
|
|
|
|
/*
|
|
* CORS middleware
|
|
*
|
|
* options can contains a list of origins
|
|
*/
|
|
module.exports = function cors(options) {
|
|
options = options || { };
|
|
var maxAge = options.maxAge || 60 * 60 * 25 * 5; // 5 days
|
|
var origins = options.origins || [ '*' ];
|
|
var allowCredentials = options.allowCredentials || false; // cookies
|
|
|
|
return function (req, res, next) {
|
|
var requestOrigin = req.headers.origin;
|
|
if (!requestOrigin) return next();
|
|
|
|
requestOrigin = url.parse(requestOrigin);
|
|
if (!requestOrigin.host) return res.status(405).send('CORS not allowed from this domain');
|
|
|
|
var hostname = requestOrigin.host.split(':')[0]; // remove any port
|
|
var originAllowed = origins.some(function (o) { return o === '*' || o === hostname; });
|
|
if (!originAllowed) {
|
|
return res.status(405).send('CORS not allowed from this domain');
|
|
}
|
|
|
|
// respond back with req.headers.origin which might contain the scheme
|
|
res.header('Access-Control-Allow-Origin', req.headers.origin);
|
|
res.header('Access-Control-Allow-Credentials', allowCredentials);
|
|
|
|
// handle preflighted requests
|
|
if (req.method === 'OPTIONS') {
|
|
if (req.headers['access-control-request-method']) {
|
|
res.header('Access-Control-Allow-Methods', 'GET, PUT, DELETE, POST, OPTIONS');
|
|
}
|
|
|
|
if (req.headers['access-control-request-headers']) {
|
|
res.header('Access-Control-Allow-Headers', req.headers['access-control-request-headers']);
|
|
}
|
|
|
|
res.header('Access-Control-Max-Age', maxAge);
|
|
|
|
return res.status(200).send();
|
|
}
|
|
|
|
if (req.headers['access-control-request-headers']) {
|
|
res.header('Access-Control-Allow-Headers', req.headers['access-control-request-headers']);
|
|
}
|
|
|
|
next();
|
|
};
|
|
};
|