released v5.0.17 - fixes #242 - corsify should clone response

kwhitley · Apr 28, 2024 · 74f63ab · 74f63ab
1 parent 9bfedb0
commit 74f63ab
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 5 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,4 +1,6 @@
 ## Changelog
+#### v5.0.17
+  - fixed: corsify should clone response before appending headers
 #### v5.0.16
   - maintenance: README
 #### v5.0.15

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "itty-router",
-  "version": "5.0.16",
+  "version": "5.0.17",
   "description": "A tiny, zero-dependency router, designed to make beautiful APIs in any environment.",
   "main": "./index.js",
   "module": "./index.mjs",

diff --git a/src/cors.spec.ts b/src/cors.spec.ts
@@ -275,6 +275,13 @@ describe('cors(options?: CorsOptions)', () => {
         expect(afterCorsify.headers.get('access-control-allow-origin')).toBeNull()
         expect(afterCorsify.status).toBe(101)
       })
+
+      it('clones the response', async () => {
+        const { corsify } = cors()
+        const originalResponse = new Response(null)
+        const corsified = corsify(originalResponse)
+        expect(originalResponse).not.toBe(corsified)
+      })
     })
   })
 })
diff --git a/src/cors.ts b/src/cors.ts
@@ -78,10 +78,7 @@ export const cors = (options: CorsOptions = {}) => {
       || response.status == 101
     ) return response
 
-    // clone the response
-    // response = response.clone()
-
-    return appendHeadersAndReturn(response, {
+    return appendHeadersAndReturn(response.clone(), {
       'access-control-allow-origin': getAccessControlOrigin(request),
       'access-control-allow-credentials': credentials,
     })