expressjs / cors / 164

100%

Pull #110

travis-ci

Shortcircuit responses to invalid origins when configured with `mismatchContinue: false`

This option enables this module to be used for basic CSRF protection as
recommended by the OWASP: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Checking_the_Origin_Header,
while remaining strictly compatible with the CORS specification by default.

When `mismatchComplete === false` and a request's origin header is either
missing or not allowed, per the module's configuration, the middleware will
terminate the request rather than execute the next handler. If
`mismatchComplete` is any other value, the middleware will execute the next
handler as before.

When the middleware terminates the request, it does so with a 400 by default
since https://httpstatuses.com/400 says that can be used for "deceptive
request routing"; this status code is configurable with `mismatchStatus`.

Fixes https://github.com/expressjs/cors/issues/109.

89 of 94 branches covered (94.68%)

Branch coverage included in aggregate %.

10 of 10 new or added lines in 1 file covered. (100.0%)

125 of 126 relevant lines covered (99.21%)

104.64 hits per line