Name: koa-cors-gate
Owner: Lad
Description: null
Created: 2017-09-21 07:43:51.0
Updated: 2017-12-01 23:50:25.0
Pushed: 2017-10-01 23:40:39.0
Homepage: https://lad.js.org
Size: 143
Language: JavaScript
GitHub Committers
| User | Most Recent Commit | # Commits |
|---|
Other Committers
| User | Most Recent Commit | # Commits |
|---|
CORS gate for Koa
npm:
install koa-cors-gate
yarn:
add koa-cors-gate
t Koa = require('koa');
t CorsGate = require('koa-cors-gate');
t app = new Koa();
use(
w CorsGate({
allowSafe: false,
origin: 'http://localhost'
.middleware
By default, koa-cors-gate will return 403 Unauthorized to any requests that aren't permitted by the specified options.
The failure option offers a means to change this behavior. This way, unauthorized cross-origin requests can be permitted in a restricted manner - perhaps by requiring an explicit authentication mechanism rather than cookie-based authentication to prevent cross-site scripting. As such, cors-gate can serve as a CSRF mechanism without the need for a token, while still allowing limited forms of third-party cross-origin API requests.
use(new CorsGate({
igin: 'http://localhost',
ilure: ({req, res}, next) => {
// requests from other origins will have this flag set.
req.requireExplicitAuthentication = true;
iddleware);
Firefox does not set the Origin header on same-origin requests (see also csrf-request-tester) for same-origin requests, as of version 53. The corsGate.originFallbackToReferrer middleware will, if the Origin header is missing, fill it with the origin part of the Referer. This middleware thus enables verification of the Origin for same-origin requests.
Additionally, no browser sends the Origin header when sending a GET request to load an image. We could simply allow all GET requests - GET requests are safe, per HTTP - but we'd rather reject unauthorized cross-origin GET requests wholesale.
At present, Chrome and Safari do not support the strict-origin Referrer-Policy, so we can only patch the Origin from the Referer on Firefox. In patching it, however, we can reject unauthorized cross-origin GET requests from images, and once Chrome and Safari support strict-origin, we'll be able to do so on all three platforms.
In order to actually reject these requests, however, the patched Origin data must be visible to the cors middleware. This middleware is distinct because it must appear before cors and corsGate to perform all the described tasks.
use(corsGate.originFallbackToReferrer());
use(cors({ ... }));
use(new CorsGate({ ... }));
| Name | Website | | —————- | —————— | | Alexis Tyler | https://wvvw.me/ |
Lad, Lass, and their respective logos are trademarks of Niftylettuce LLC. These trademarks may not be reproduced, distributed, transmitted, or otherwise used, except with the prior written permission of Niftylettuce LLC. If you are seeking permission to use these trademarks, then please contact us.