Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CORSANYWHERE_TARGETWHITELIST allows proxy owner to specify targets that are allowed to be proxied through the server #414

Closed
wants to merge 3 commits into from
Closed

CORSANYWHERE_TARGETWHITELIST allows proxy owner to specify targets that are allowed to be proxied through the server #414

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9a2cbf8
Added targetWhitelist variables
gwxtqryio98 Feb 18, 2022
e7277d3
Added targetWhitelist code
gwxtqryio98 Feb 18, 2022
bc29164
Fixed typo
gwxtqryio98 Feb 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions lib/cors-anywhere.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -261,6 +261,7 @@ function getHandler(options, proxy) {
maxRedirects: 5, // Maximum number of redirects to be followed.
originBlacklist: [], // Requests from these origins will be blocked.
originWhitelist: [], // If non-empty, requests not from an origin in this list will be blocked.
targetWhitelist: [], // If non-empty, requests not for a target in this list will be blocked.
checkRateLimit: null, // Function that may enforce a rate-limit by returning a non-empty string.
redirectSameOrigin: false, // Redirect the client to the requested URL for same-origin requests.
requireHeader: null, // Require a header to be set?
Expand Down Expand Up @@ -370,6 +371,12 @@ function getHandler(options, proxy) {
res.end('The origin "' + origin + '" was not whitelisted by the operator of this proxy.');
return;
}

if (corsAnywhere.targetWhitelist.length && corsAnywhere.targetWhitelist.indexOf(location.href) === -1) {
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the use case for this? This exact match is quite inflexible. If you use cors-anywhere as a library, then you can already enforce this kind of target restriction by comparing req.url.slice(1) with the target whitelist.

To learn more about potential implementation details to improve the design, see #78. See also the review feedback at #111.

res.writeHead(403, 'Forbidden', cors_headers);
res.end('The target "' + location.href + '" was not whitelisted by the operator of this proxy.');
return;
}

var rateLimitMessage = corsAnywhere.checkRateLimit && corsAnywhere.checkRateLimit(origin);
if (rateLimitMessage) {
Expand Down
2 changes: 2 additions & 0 deletions server.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ var port = process.env.PORT || 8080;
// use originWhitelist instead.
var originBlacklist = parseEnvList(process.env.CORSANYWHERE_BLACKLIST);
var originWhitelist = parseEnvList(process.env.CORSANYWHERE_WHITELIST);
var targetWhitelist = parseEnvList(process.env.CORSANYWHERE_TARGETWHITELIST);
function parseEnvList(env) {
if (!env) {
return [];
Expand All @@ -23,6 +24,7 @@ var cors_proxy = require('./lib/cors-anywhere');
cors_proxy.createServer({
originBlacklist: originBlacklist,
originWhitelist: originWhitelist,
targetWhitelist: targetWhitelist,
requireHeader: ['origin', 'x-requested-with'],
checkRateLimit: checkRateLimit,
removeHeaders: [
Expand Down