Skip to content

Commit 034bb13

Browse files
laatlaat
authored
vary origin on delegated options (#292)
1 parent 3cf8f61 commit 034bb13

File tree

3 files changed

+33
-32
lines changed

3 files changed

+33
-32
lines changed

‎index.js

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ function handleCorsOptionsDelegator (optionsResolver, fastify, opts, next) {
104104
fastify.addHook(hook, function handleCors (req, reply, payload, next) {
105105
const ret = optionsResolver(req)
106106
if (ret && typeof ret.then === 'function') {
107-
ret.then(options => addCorsHeadersHandler(fastify, normalizeCorsOptions(options), req, reply, next)).catch(next)
107+
ret.then(options => addCorsHeadersHandler(fastify, normalizeCorsOptions(options, true), req, reply, next)).catch(next)
108108
return
109109
}
110110
next(new Error('Invalid CORS origin option'))
@@ -114,7 +114,7 @@ function handleCorsOptionsDelegator (optionsResolver, fastify, opts, next) {
114114
fastify.addHook(hook, function handleCors (req, reply, next) {
115115
const ret = optionsResolver(req)
116116
if (ret && typeof ret.then === 'function') {
117-
ret.then(options => addCorsHeadersHandler(fastify, normalizeCorsOptions(options), req, reply, next)).catch(next)
117+
ret.then(options => addCorsHeadersHandler(fastify, normalizeCorsOptions(options, true), req, reply, next)).catch(next)
118118
return
119119
}
120120
next(new Error('Invalid CORS origin option'))
@@ -128,15 +128,15 @@ function handleCorsOptionsCallbackDelegator (optionsResolver, fastify, req, repl
128128
if (err) {
129129
next(err)
130130
} else {
131-
addCorsHeadersHandler(fastify, normalizeCorsOptions(options), req, reply, next)
131+
addCorsHeadersHandler(fastify, normalizeCorsOptions(options, true), req, reply, next)
132132
}
133133
})
134134
}
135135

136136
/**
137137
* @param {import('./types').FastifyCorsOptions} opts
138138
*/
139-
function normalizeCorsOptions (opts) {
139+
function normalizeCorsOptions (opts, dynamic) {
140140
const corsOptions = { ...defaultOptions, ...opts }
141141
if (Array.isArray(opts.origin) && opts.origin.indexOf('*') !== -1) {
142142
corsOptions.origin = '*'
@@ -148,11 +148,12 @@ function normalizeCorsOptions (opts) {
148148
// strings are applied directly and any other value is ignored
149149
corsOptions.cacheControl = null
150150
}
151+
corsOptions.dynamic = dynamic || false
151152
return corsOptions
152153
}
153154

154155
function addCorsHeadersHandler (fastify, options, req, reply, next) {
155-
if (typeof options.origin !== 'string' && options.origin !== false) {
156+
if ((typeof options.origin !== 'string' && options.origin !== false) || options.dynamic) {
156157
// Always set Vary header for non-static origin option
157158
// https://fetch.spec.whatwg.org/#cors-protocol-and-http-caches
158159
addOriginToVaryHeader(reply)

‎test/cors.test.js

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ test('Should add cors headers (custom values)', t => {
124124
})
125125

126126
test('Should support dynamic config (callback)', t => {
127-
t.plan(18)
127+
t.plan(16)
128128

129129
const configs = [{
130130
origin: 'example.com',
@@ -177,9 +177,9 @@ test('Should support dynamic config (callback)', t => {
177177
'access-control-allow-origin': 'example.com',
178178
'access-control-allow-credentials': 'true',
179179
'access-control-expose-headers': 'foo, bar',
180-
'content-length': '2'
180+
'content-length': '2',
181+
vary: 'Origin'
181182
})
182-
t.notMatch(res.headers, { vary: 'Origin' })
183183
})
184184

185185
fastify.inject({
@@ -202,9 +202,9 @@ test('Should support dynamic config (callback)', t => {
202202
'access-control-allow-headers': 'baz, foo',
203203
'access-control-max-age': '321',
204204
'cache-control': '456',
205-
'content-length': '0'
205+
'content-length': '0',
206+
vary: 'Origin'
206207
})
207-
t.notMatch(res.headers, { vary: 'Origin' })
208208
})
209209

210210
fastify.inject({
@@ -221,7 +221,7 @@ test('Should support dynamic config (callback)', t => {
221221
})
222222

223223
test('Should support dynamic config (Promise)', t => {
224-
t.plan(26)
224+
t.plan(23)
225225

226226
const configs = [{
227227
origin: 'example.com',
@@ -282,9 +282,9 @@ test('Should support dynamic config (Promise)', t => {
282282
'access-control-allow-origin': 'example.com',
283283
'access-control-allow-credentials': 'true',
284284
'access-control-expose-headers': 'foo, bar',
285-
'content-length': '2'
285+
'content-length': '2',
286+
vary: 'Origin'
286287
})
287-
t.notMatch(res.headers, { vary: 'Origin' })
288288
})
289289

290290
fastify.inject({
@@ -306,9 +306,9 @@ test('Should support dynamic config (Promise)', t => {
306306
'access-control-allow-methods': 'GET',
307307
'access-control-allow-headers': 'baz, foo',
308308
'access-control-max-age': '321',
309-
'content-length': '0'
309+
'content-length': '0',
310+
vary: 'Origin'
310311
})
311-
t.notMatch(res.headers, { vary: 'Origin' })
312312
t.equal(res.headers['cache-control'], undefined, 'cache-control omitted (invalid value)')
313313
})
314314

@@ -332,9 +332,9 @@ test('Should support dynamic config (Promise)', t => {
332332
'access-control-allow-headers': 'baz, foo',
333333
'access-control-max-age': '321',
334334
'cache-control': 'public, max-age=456', // cache-control included (custom string)
335-
'content-length': '0'
335+
'content-length': '0',
336+
vary: 'Origin'
336337
})
337-
t.notMatch(res.headers, { vary: 'Origin' })
338338
})
339339

340340
fastify.inject({

‎test/hooks.test.js

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -321,7 +321,7 @@ test('Should set hook preSerialization if hook option is set to preSerialization
321321
})
322322

323323
test('Should support custom hook with dynamic config', t => {
324-
t.plan(18)
324+
t.plan(16)
325325

326326
const configs = [{
327327
origin: 'example.com',
@@ -375,9 +375,9 @@ test('Should support custom hook with dynamic config', t => {
375375
'access-control-allow-origin': 'example.com',
376376
'access-control-allow-credentials': 'true',
377377
'access-control-expose-headers': 'foo, bar',
378-
'content-length': '2'
378+
'content-length': '2',
379+
vary: 'Origin'
379380
})
380-
t.notMatch(res.headers, { vary: 'Origin' })
381381
})
382382

383383
fastify.inject({
@@ -399,9 +399,9 @@ test('Should support custom hook with dynamic config', t => {
399399
'access-control-allow-methods': 'GET',
400400
'access-control-allow-headers': 'baz, foo',
401401
'access-control-max-age': '321',
402-
'content-length': '0'
402+
'content-length': '0',
403+
vary: 'Origin'
403404
})
404-
t.notMatch(res.headers, { vary: 'Origin' })
405405
})
406406

407407
fastify.inject({
@@ -418,7 +418,7 @@ test('Should support custom hook with dynamic config', t => {
418418
})
419419

420420
test('Should support custom hook with dynamic config (callback)', t => {
421-
t.plan(18)
421+
t.plan(16)
422422

423423
const configs = [{
424424
origin: 'example.com',
@@ -472,9 +472,9 @@ test('Should support custom hook with dynamic config (callback)', t => {
472472
'access-control-allow-origin': 'example.com',
473473
'access-control-allow-credentials': 'true',
474474
'access-control-expose-headers': 'foo, bar',
475-
'content-length': '2'
475+
'content-length': '2',
476+
vary: 'Origin'
476477
})
477-
t.notMatch(res.headers, { vary: 'Origin' })
478478
})
479479

480480
fastify.inject({
@@ -496,9 +496,9 @@ test('Should support custom hook with dynamic config (callback)', t => {
496496
'access-control-allow-methods': 'GET',
497497
'access-control-allow-headers': 'baz, foo',
498498
'access-control-max-age': '321',
499-
'content-length': '0'
499+
'content-length': '0',
500+
vary: 'Origin'
500501
})
501-
t.notMatch(res.headers, { vary: 'Origin' })
502502
})
503503

504504
fastify.inject({
@@ -515,7 +515,7 @@ test('Should support custom hook with dynamic config (callback)', t => {
515515
})
516516

517517
test('Should support custom hook with dynamic config (Promise)', t => {
518-
t.plan(18)
518+
t.plan(16)
519519

520520
const configs = [{
521521
origin: 'example.com',
@@ -570,9 +570,9 @@ test('Should support custom hook with dynamic config (Promise)', t => {
570570
'access-control-allow-origin': 'example.com',
571571
'access-control-allow-credentials': 'true',
572572
'access-control-expose-headers': 'foo, bar',
573-
'content-length': '2'
573+
'content-length': '2',
574+
vary: 'Origin'
574575
})
575-
t.notMatch(res.headers, { vary: 'Origin' })
576576
})
577577

578578
fastify.inject({
@@ -594,9 +594,9 @@ test('Should support custom hook with dynamic config (Promise)', t => {
594594
'access-control-allow-methods': 'GET',
595595
'access-control-allow-headers': 'baz, foo',
596596
'access-control-max-age': '321',
597-
'content-length': '0'
597+
'content-length': '0',
598+
vary: 'Origin'
598599
})
599-
t.notMatch(res.headers, { vary: 'Origin' })
600600
})
601601

602602
fastify.inject({

0 commit comments

Comments
 (0)