forked from ampproject/amphtml
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update CORS, add AMP-Same-Origin when Origin is missing on same origi…
…n requests (ampproject#4879)
- Loading branch information
Showing
8 changed files
with
282 additions
and
95 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -98,21 +98,7 @@ const SOURCE_ORIGIN_REGEX = new RegExp('^http://localhost:8000|' + | |
| '^https?://.+\.herokuapp\.com:8000/'); | ||
|
|
||
| app.use('/form/html/post', function(req, res) { | ||
| if (!ORIGIN_REGEX.test(req.headers.origin)) { | ||
| res.statusCode = 500; | ||
| res.end(JSON.stringify({ | ||
| message: 'Origin header is invalid.' | ||
| })); | ||
| return; | ||
| } | ||
|
|
||
| if (!SOURCE_ORIGIN_REGEX.test(req.query.__amp_source_origin)) { | ||
| res.statusCode = 500; | ||
| res.end(JSON.stringify({ | ||
| message: '__amp_source_origin parameter is invalid.' | ||
| })); | ||
| return; | ||
| } | ||
| assertCors(req, res, ['POST']); | ||
|
|
||
| var form = new formidable.IncomingForm(); | ||
| form.parse(req, function(err, fields) { | ||
|
|
@@ -132,39 +118,83 @@ app.use('/form/html/post', function(req, res) { | |
| }); | ||
| }); | ||
|
|
||
| app.use('/form/echo-json/post', function(req, res) { | ||
| if (!ORIGIN_REGEX.test(req.headers.origin)) { | ||
| res.statusCode = 500; | ||
| res.end(JSON.stringify({ | ||
| message: 'Origin header is invalid.' | ||
| })); | ||
| return; | ||
| function assertCors(req, res, opt_validMethods) { | ||
| const validMethods = opt_validMethods || ['GET', 'POST', 'OPTIONS']; | ||
| const invalidMethod = req.method + ' method is not allowed. Use POST.'; | ||
| const invalidOrigin = 'Origin header is invalid.'; | ||
| const invalidSourceOrigin = '__amp_source_origin parameter is invalid.'; | ||
| const unauthorized = 'Unauthorized Request'; | ||
| var origin; | ||
|
|
||
| if (validMethods.indexOf(req.method) == -1) { | ||
| res.statusCode = 405; | ||
| res.end(JSON.stringify({message: invalidMethod})); | ||
| throw invalidMethod; | ||
| } | ||
|
|
||
| if (!SOURCE_ORIGIN_REGEX.test(req.query.__amp_source_origin)) { | ||
| res.statusCode = 500; | ||
| res.end(JSON.stringify({ | ||
| message: '__amp_source_origin parameter is invalid.' | ||
| })); | ||
| return; | ||
| if (req.headers.origin) { | ||
| origin = req.headers.origin; | ||
| if (!ORIGIN_REGEX.test(req.headers.origin)) { | ||
| res.statusCode = 500; | ||
| res.end(JSON.stringify({message: invalidOrigin})); | ||
| throw invalidOrigin; | ||
| } | ||
|
|
||
| if (!SOURCE_ORIGIN_REGEX.test(req.query.__amp_source_origin)) { | ||
| res.statusCode = 500; | ||
| res.end(JSON.stringify({message: invalidSourceOrigin})); | ||
| throw invalidSourceOrigin; | ||
| } | ||
| } else if (req.headers['amp-same-origin'] == 'true') { | ||
| origin = getUrlPrefix(req); | ||
| } else { | ||
| res.statusCode = 401; | ||
| res.end(JSON.stringify({message: unauthorized})); | ||
| throw unauthorized; | ||
| } | ||
|
|
||
| res.setHeader('Access-Control-Allow-Credentials', 'true'); | ||
| res.setHeader('Access-Control-Allow-Origin', origin); | ||
| res.setHeader('Access-Control-Expose-Headers', | ||
| 'AMP-Access-Control-Allow-Source-Origin') | ||
| res.setHeader('AMP-Access-Control-Allow-Source-Origin', | ||
| req.query.__amp_source_origin); | ||
| } | ||
|
|
||
| app.use('/form/echo-json/post', function(req, res) { | ||
| assertCors(req, res, ['POST']); | ||
| var form = new formidable.IncomingForm(); | ||
| form.parse(req, function(err, fields) { | ||
| res.setHeader('Content-Type', 'application/json'); | ||
| if (fields['email'] == '[email protected]') { | ||
| res.statusCode = 500; | ||
| } | ||
| res.setHeader('Access-Control-Allow-Origin', | ||
| req.headers.origin); | ||
| res.setHeader('Access-Control-Expose-Headers', | ||
| 'AMP-Access-Control-Allow-Source-Origin') | ||
| res.setHeader('AMP-Access-Control-Allow-Source-Origin', | ||
| req.query.__amp_source_origin); | ||
| res.end(JSON.stringify(fields)); | ||
| }); | ||
| }); | ||
|
|
||
|
|
||
| app.use('/form/search-html/get', function(req, res) { | ||
| res.setHeader('Content-Type', 'text/html'); | ||
| res.end(` | ||
| <h1>Here's results for your search<h1> | ||
| <ul> | ||
| <li>Result 1</li> | ||
| <li>Result 2</li> | ||
| <li>Result 3</li> | ||
| </ul> | ||
| `); | ||
| }); | ||
|
|
||
|
|
||
| app.use('/form/search-json/get', function(req, res) { | ||
| assertCors(req, res, ['GET']); | ||
| res.json({ | ||
| results: [{title: 'Result 1'}, {title: 'Result 2'}, {title: 'Result 3'}] | ||
| }); | ||
| }); | ||
|
|
||
|
|
||
| app.use('/share-tracking/get-outgoing-fragment', function(req, res) { | ||
| res.setHeader('AMP-Access-Control-Allow-Source-Origin', | ||
| req.protocol + '://' + req.headers.host); | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.