File size: 2,241 Bytes
1f21206 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 | /**
* CORS middleware for desktop and temporary open H5 access.
*/
import { isLoopbackHost } from '../h5AccessPolicy.js'
export function corsHeaders(origin?: string | null): Record<string, string> {
const allowedOrigin = origin || 'http://localhost:3000'
return {
'Access-Control-Allow-Origin': allowedOrigin,
'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',
'Access-Control-Allow-Headers': 'Content-Type, Authorization',
'Access-Control-Max-Age': '86400',
Vary: 'Origin',
}
}
function baseCorsHeaders(): Record<string, string> {
return {
'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',
'Access-Control-Allow-Headers': 'Content-Type, Authorization',
'Access-Control-Max-Age': '86400',
Vary: 'Origin',
}
}
export type CorsResolution = {
allowed: boolean
rejected: boolean
headers: Record<string, string>
}
export type CorsResolutionOptions = {
h5Enabled?: boolean
isOriginAllowed?: (origin: string) => Promise<boolean>
}
const LOCAL_ORIGINS = new Set([
'http://tauri.localhost',
'https://tauri.localhost',
'tauri://localhost',
])
function isLocalOrigin(origin?: string | null): boolean {
if (!origin) {
return true
}
if (LOCAL_ORIGINS.has(origin)) {
return true
}
try {
return isLoopbackHost(new URL(origin).hostname)
} catch {
return false
}
}
export async function resolveCors(
origin?: string | null,
_requestOrigin?: string | null,
options: CorsResolutionOptions = {},
): Promise<CorsResolution> {
if (!origin) {
return {
allowed: true,
rejected: false,
headers: corsHeaders(origin),
}
}
if (!options.h5Enabled || isLocalOrigin(origin)) {
return {
allowed: true,
rejected: false,
headers: {
...baseCorsHeaders(),
'Access-Control-Allow-Origin': origin,
},
}
}
if (options.isOriginAllowed && await options.isOriginAllowed(origin)) {
return {
allowed: true,
rejected: false,
headers: {
...baseCorsHeaders(),
'Access-Control-Allow-Origin': origin,
},
}
}
return {
allowed: false,
rejected: true,
headers: baseCorsHeaders(),
}
}
|