This commit is contained in:
2025-06-26 03:35:15 +00:00
parent 56fa52fd80
commit 59f287112f
2193 changed files with 289518 additions and 3540 deletions

View File

@@ -0,0 +1,243 @@
# cors
[![NPM Version][npm-image]][npm-url]
[![NPM Downloads][downloads-image]][downloads-url]
[![Build Status][travis-image]][travis-url]
[![Test Coverage][coveralls-image]][coveralls-url]
CORS is a node.js package for providing a [Connect](http://www.senchalabs.org/connect/)/[Express](http://expressjs.com/) middleware that can be used to enable [CORS](http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) with various options.
**[Follow me (@troygoode) on Twitter!](https://twitter.com/intent/user?screen_name=troygoode)**
* [Installation](#installation)
* [Usage](#usage)
* [Simple Usage](#simple-usage-enable-all-cors-requests)
* [Enable CORS for a Single Route](#enable-cors-for-a-single-route)
* [Configuring CORS](#configuring-cors)
* [Configuring CORS Asynchronously](#configuring-cors-asynchronously)
* [Enabling CORS Pre-Flight](#enabling-cors-pre-flight)
* [Configuration Options](#configuration-options)
* [Demo](#demo)
* [License](#license)
* [Author](#author)
## Installation
This is a [Node.js](https://nodejs.org/en/) module available through the
[npm registry](https://www.npmjs.com/). Installation is done using the
[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
```sh
$ npm install cors
```
## Usage
### Simple Usage (Enable *All* CORS Requests)
```javascript
var express = require('express')
var cors = require('cors')
var app = express()
app.use(cors())
app.get('/products/:id', function (req, res, next) {
res.json({msg: 'This is CORS-enabled for all origins!'})
})
app.listen(80, function () {
console.log('CORS-enabled web server listening on port 80')
})
```
### Enable CORS for a Single Route
```javascript
var express = require('express')
var cors = require('cors')
var app = express()
app.get('/products/:id', cors(), function (req, res, next) {
res.json({msg: 'This is CORS-enabled for a Single Route'})
})
app.listen(80, function () {
console.log('CORS-enabled web server listening on port 80')
})
```
### Configuring CORS
```javascript
var express = require('express')
var cors = require('cors')
var app = express()
var corsOptions = {
origin: 'http://example.com',
optionsSuccessStatus: 200 // some legacy browsers (IE11, various SmartTVs) choke on 204
}
app.get('/products/:id', cors(corsOptions), function (req, res, next) {
res.json({msg: 'This is CORS-enabled for only example.com.'})
})
app.listen(80, function () {
console.log('CORS-enabled web server listening on port 80')
})
```
### Configuring CORS w/ Dynamic Origin
```javascript
var express = require('express')
var cors = require('cors')
var app = express()
var whitelist = ['http://example1.com', 'http://example2.com']
var corsOptions = {
origin: function (origin, callback) {
if (whitelist.indexOf(origin) !== -1) {
callback(null, true)
} else {
callback(new Error('Not allowed by CORS'))
}
}
}
app.get('/products/:id', cors(corsOptions), function (req, res, next) {
res.json({msg: 'This is CORS-enabled for a whitelisted domain.'})
})
app.listen(80, function () {
console.log('CORS-enabled web server listening on port 80')
})
```
If you do not want to block REST tools or server-to-server requests,
add a `!origin` check in the origin function like so:
```javascript
var corsOptions = {
origin: function (origin, callback) {
if (whitelist.indexOf(origin) !== -1 || !origin) {
callback(null, true)
} else {
callback(new Error('Not allowed by CORS'))
}
}
}
```
### Enabling CORS Pre-Flight
Certain CORS requests are considered 'complex' and require an initial
`OPTIONS` request (called the "pre-flight request"). An example of a
'complex' CORS request is one that uses an HTTP verb other than
GET/HEAD/POST (such as DELETE) or that uses custom headers. To enable
pre-flighting, you must add a new OPTIONS handler for the route you want
to support:
```javascript
var express = require('express')
var cors = require('cors')
var app = express()
app.options('/products/:id', cors()) // enable pre-flight request for DELETE request
app.del('/products/:id', cors(), function (req, res, next) {
res.json({msg: 'This is CORS-enabled for all origins!'})
})
app.listen(80, function () {
console.log('CORS-enabled web server listening on port 80')
})
```
You can also enable pre-flight across-the-board like so:
```javascript
app.options('*', cors()) // include before other routes
```
### Configuring CORS Asynchronously
```javascript
var express = require('express')
var cors = require('cors')
var app = express()
var whitelist = ['http://example1.com', 'http://example2.com']
var corsOptionsDelegate = function (req, callback) {
var corsOptions;
if (whitelist.indexOf(req.header('Origin')) !== -1) {
corsOptions = { origin: true } // reflect (enable) the requested origin in the CORS response
} else {
corsOptions = { origin: false } // disable CORS for this request
}
callback(null, corsOptions) // callback expects two parameters: error and options
}
app.get('/products/:id', cors(corsOptionsDelegate), function (req, res, next) {
res.json({msg: 'This is CORS-enabled for a whitelisted domain.'})
})
app.listen(80, function () {
console.log('CORS-enabled web server listening on port 80')
})
```
## Configuration Options
* `origin`: Configures the **Access-Control-Allow-Origin** CORS header. Possible values:
- `Boolean` - set `origin` to `true` to reflect the [request origin](http://tools.ietf.org/html/draft-abarth-origin-09), as defined by `req.header('Origin')`, or set it to `false` to disable CORS.
- `String` - set `origin` to a specific origin. For example if you set it to `"http://example.com"` only requests from "http://example.com" will be allowed.
- `RegExp` - set `origin` to a regular expression pattern which will be used to test the request origin. If it's a match, the request origin will be reflected. For example the pattern `/example\.com$/` will reflect any request that is coming from an origin ending with "example.com".
- `Array` - set `origin` to an array of valid origins. Each origin can be a `String` or a `RegExp`. For example `["http://example1.com", /\.example2\.com$/]` will accept any request from "http://example1.com" or from a subdomain of "example2.com".
- `Function` - set `origin` to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (which expects the signature `err [object], allow [bool]`) as the second.
* `methods`: Configures the **Access-Control-Allow-Methods** CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: `['GET', 'PUT', 'POST']`).
* `allowedHeaders`: Configures the **Access-Control-Allow-Headers** CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: `['Content-Type', 'Authorization']`). If not specified, defaults to reflecting the headers specified in the request's **Access-Control-Request-Headers** header.
* `exposedHeaders`: Configures the **Access-Control-Expose-Headers** CORS header. Expects a comma-delimited string (ex: 'Content-Range,X-Content-Range') or an array (ex: `['Content-Range', 'X-Content-Range']`). If not specified, no custom headers are exposed.
* `credentials`: Configures the **Access-Control-Allow-Credentials** CORS header. Set to `true` to pass the header, otherwise it is omitted.
* `maxAge`: Configures the **Access-Control-Max-Age** CORS header. Set to an integer to pass the header, otherwise it is omitted.
* `preflightContinue`: Pass the CORS preflight response to the next handler.
* `optionsSuccessStatus`: Provides a status code to use for successful `OPTIONS` requests, since some legacy browsers (IE11, various SmartTVs) choke on `204`.
The default configuration is the equivalent of:
```json
{
"origin": "*",
"methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
"preflightContinue": false,
"optionsSuccessStatus": 204
}
```
For details on the effect of each CORS header, read [this](http://www.html5rocks.com/en/tutorials/cors/) article on HTML5 Rocks.
## Demo
A demo that illustrates CORS working (and not working) using jQuery is available here: [http://node-cors-client.herokuapp.com/](http://node-cors-client.herokuapp.com/)
Code for that demo can be found here:
* Client: [https://github.com/TroyGoode/node-cors-client](https://github.com/TroyGoode/node-cors-client)
* Server: [https://github.com/TroyGoode/node-cors-server](https://github.com/TroyGoode/node-cors-server)
## License
[MIT License](http://www.opensource.org/licenses/mit-license.php)
## Author
[Troy Goode](https://github.com/TroyGoode) ([troygoode@gmail.com](mailto:troygoode@gmail.com))
[coveralls-image]: https://img.shields.io/coveralls/expressjs/cors/master.svg
[coveralls-url]: https://coveralls.io/r/expressjs/cors?branch=master
[downloads-image]: https://img.shields.io/npm/dm/cors.svg
[downloads-url]: https://npmjs.org/package/cors
[npm-image]: https://img.shields.io/npm/v/cors.svg
[npm-url]: https://npmjs.org/package/cors
[travis-image]: https://img.shields.io/travis/expressjs/cors/master.svg
[travis-url]: https://travis-ci.org/expressjs/cors

View File

@@ -0,0 +1,234 @@
const path = require('path');
const fs = require('fs');
const existsSync = fs.existsSync;
const utils = require('../utils');
module.exports = exec;
module.exports.expandScript = expandScript;
/**
* Reads the cwd/package.json file and looks to see if it can load a script
* and possibly an exec first from package.main, then package.start.
*
* @return {Object} exec & script if found
*/
function execFromPackage() {
// doing a try/catch because we can't use the path.exist callback pattern
// or we could, but the code would get messy, so this will do exactly
// what we're after - if the file doesn't exist, it'll throw.
try {
// note: this isn't nodemon's package, it's the user's cwd package
var pkg = require(path.join(process.cwd(), 'package.json'));
if (pkg.main !== undefined) {
// no app found to run - so give them a tip and get the feck out
return { exec: null, script: pkg.main };
}
if (pkg.scripts && pkg.scripts.start) {
return { exec: pkg.scripts.start };
}
} catch (e) {}
return null;
}
function replace(map, str) {
var re = new RegExp('{{(' + Object.keys(map).join('|') + ')}}', 'g');
return str.replace(re, function (all, m) {
return map[m] || all || '';
});
}
function expandScript(script, ext) {
if (!ext) {
ext = '.js';
}
if (script.indexOf(ext) !== -1) {
return script;
}
if (existsSync(path.resolve(script))) {
return script;
}
if (existsSync(path.resolve(script + ext))) {
return script + ext;
}
return script;
}
/**
* Discovers all the options required to run the script
* and if a custom exec has been passed in, then it will
* also try to work out what extensions to monitor and
* whether there's a special way of running that script.
*
* @param {Object} nodemonOptions
* @param {Object} execMap
* @return {Object} new and updated version of nodemonOptions
*/
function exec(nodemonOptions, execMap) {
if (!execMap) {
execMap = {};
}
var options = utils.clone(nodemonOptions || {});
var script;
// if there's no script passed, try to get it from the first argument
if (!options.script && (options.args || []).length) {
script = expandScript(
options.args[0],
options.ext && '.' + (options.ext || 'js').split(',')[0]
);
// if the script was found, shift it off our args
if (script !== options.args[0]) {
options.script = script;
options.args.shift();
}
}
// if there's no exec found yet, then try to read it from the local
// package.json this logic used to sit in the cli/parse, but actually the cli
// should be parsed first, then the user options (via nodemon.json) then
// finally default down to pot shots at the directory via package.json
if (!options.exec && !options.script) {
var found = execFromPackage();
if (found !== null) {
if (found.exec) {
options.exec = found.exec;
}
if (!options.script) {
options.script = found.script;
}
if (Array.isArray(options.args) && options.scriptPosition === null) {
options.scriptPosition = options.args.length;
}
}
}
// var options = utils.clone(nodemonOptions || {});
script = path.basename(options.script || '');
var scriptExt = path.extname(script).slice(1);
var extension = options.ext;
if (extension === undefined) {
var isJS = scriptExt === 'js' || scriptExt === 'mjs' || scriptExt === 'cjs';
extension = isJS || !scriptExt ? 'js,mjs,cjs' : scriptExt;
extension += ',json'; // Always watch JSON files
}
var execDefined = !!options.exec;
// allows the user to simplify cli usage:
// https://github.com/remy/nodemon/issues/195
// but always give preference to the user defined argument
if (!options.exec && execMap[scriptExt] !== undefined) {
options.exec = execMap[scriptExt];
execDefined = true;
}
options.execArgs = nodemonOptions.execArgs || [];
if (Array.isArray(options.exec)) {
options.execArgs = options.exec;
options.exec = options.execArgs.shift();
}
if (options.exec === undefined) {
options.exec = 'node';
} else {
// allow variable substitution for {{filename}} and {{pwd}}
var substitution = replace.bind(null, {
filename: options.script,
pwd: process.cwd(),
});
var newExec = substitution(options.exec);
if (
newExec !== options.exec &&
options.exec.indexOf('{{filename}}') !== -1
) {
options.script = null;
}
options.exec = newExec;
var newExecArgs = options.execArgs.map(substitution);
if (newExecArgs.join('') !== options.execArgs.join('')) {
options.execArgs = newExecArgs;
delete options.script;
}
}
if (options.exec === 'node' && options.nodeArgs && options.nodeArgs.length) {
options.execArgs = options.execArgs.concat(options.nodeArgs);
}
// note: indexOf('coffee') handles both .coffee and .litcoffee
if (
!execDefined &&
options.exec === 'node' &&
scriptExt.indexOf('coffee') !== -1
) {
options.exec = 'coffee';
// we need to get execArgs set before the script
// for example, in `nodemon --debug my-script.coffee --my-flag`, debug is an
// execArg, while my-flag is a script arg
var leadingArgs = (options.args || []).splice(0, options.scriptPosition);
options.execArgs = options.execArgs.concat(leadingArgs);
options.scriptPosition = 0;
if (options.execArgs.length > 0) {
// because this is the coffee executable, we need to combine the exec args
// into a single argument after the nodejs flag
options.execArgs = ['--nodejs', options.execArgs.join(' ')];
}
}
if (options.exec === 'coffee') {
// don't override user specified extension tracking
if (options.ext === undefined) {
if (extension) {
extension += ',';
}
extension += 'coffee,litcoffee';
}
// because windows can't find 'coffee', it needs the real file 'coffee.cmd'
if (utils.isWindows) {
options.exec += '.cmd';
}
}
// allow users to make a mistake on the extension to monitor
// converts .js, pug => js,pug
// BIG NOTE: user can't do this: nodemon -e *.js
// because the terminal will automatically expand the glob against
// the file system :(
extension = (extension.match(/[^,*\s]+/g) || [])
.map((ext) => ext.replace(/^\./, ''))
.join(',');
options.ext = extension;
if (options.script) {
options.script = expandScript(
options.script,
extension && '.' + extension.split(',')[0]
);
}
options.env = {};
// make sure it's an object (and since we don't have )
if ({}.toString.apply(nodemonOptions.env) === '[object Object]') {
options.env = utils.clone(nodemonOptions.env);
} else if (nodemonOptions.env !== undefined) {
throw new Error('nodemon env values must be an object: { PORT: 8000 }');
}
return options;
}

View File

@@ -0,0 +1,109 @@
"use strict";
var Buffer = require("safer-buffer").Buffer;
// NOTE: Due to 'stream' module being pretty large (~100Kb, significant in browser environments),
// we opt to dependency-inject it instead of creating a hard dependency.
module.exports = function(stream_module) {
var Transform = stream_module.Transform;
// == Encoder stream =======================================================
function IconvLiteEncoderStream(conv, options) {
this.conv = conv;
options = options || {};
options.decodeStrings = false; // We accept only strings, so we don't need to decode them.
Transform.call(this, options);
}
IconvLiteEncoderStream.prototype = Object.create(Transform.prototype, {
constructor: { value: IconvLiteEncoderStream }
});
IconvLiteEncoderStream.prototype._transform = function(chunk, encoding, done) {
if (typeof chunk != 'string')
return done(new Error("Iconv encoding stream needs strings as its input."));
try {
var res = this.conv.write(chunk);
if (res && res.length) this.push(res);
done();
}
catch (e) {
done(e);
}
}
IconvLiteEncoderStream.prototype._flush = function(done) {
try {
var res = this.conv.end();
if (res && res.length) this.push(res);
done();
}
catch (e) {
done(e);
}
}
IconvLiteEncoderStream.prototype.collect = function(cb) {
var chunks = [];
this.on('error', cb);
this.on('data', function(chunk) { chunks.push(chunk); });
this.on('end', function() {
cb(null, Buffer.concat(chunks));
});
return this;
}
// == Decoder stream =======================================================
function IconvLiteDecoderStream(conv, options) {
this.conv = conv;
options = options || {};
options.encoding = this.encoding = 'utf8'; // We output strings.
Transform.call(this, options);
}
IconvLiteDecoderStream.prototype = Object.create(Transform.prototype, {
constructor: { value: IconvLiteDecoderStream }
});
IconvLiteDecoderStream.prototype._transform = function(chunk, encoding, done) {
if (!Buffer.isBuffer(chunk) && !(chunk instanceof Uint8Array))
return done(new Error("Iconv decoding stream needs buffers as its input."));
try {
var res = this.conv.write(chunk);
if (res && res.length) this.push(res, this.encoding);
done();
}
catch (e) {
done(e);
}
}
IconvLiteDecoderStream.prototype._flush = function(done) {
try {
var res = this.conv.end();
if (res && res.length) this.push(res, this.encoding);
done();
}
catch (e) {
done(e);
}
}
IconvLiteDecoderStream.prototype.collect = function(cb) {
var res = '';
this.on('error', cb);
this.on('data', function(chunk) { res += chunk; });
this.on('end', function() {
cb(null, res);
});
return this;
}
return {
IconvLiteEncoderStream: IconvLiteEncoderStream,
IconvLiteDecoderStream: IconvLiteDecoderStream,
};
};