expressjs / cors / 164

pending completion

Build # 164

Build Type

Pull #110

travis-ci

Committed by

web-flow

Commit Message

Shortcircuit responses to invalid origins when configured with `mismatchContinue: false`

This option enables this module to be used for basic CSRF protection as
recommended by the OWASP: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Checking_the_Origin_Header,
while remaining strictly compatible with the CORS specification by default.

When `mismatchComplete === false` and a request's origin header is either
missing or not allowed, per the module's configuration, the middleware will
terminate the request rather than execute the next handler. If
`mismatchComplete` is any other value, the middleware will execute the next
handler as before.

When the middleware terminates the request, it does so with a 400 by default
since https://httpstatuses.com/400 says that can be used for "deceptive
request routing"; this status code is configurable with `mismatchStatus`.

Fixes https://github.com/expressjs/cors/issues/109.

Pull Request Pull Request #110: Shortcircuit responses to invalid origins when configured with `mismatchContinue: false`

Run Details

89 of 94 branches covered (94.68%)

Branch coverage included in aggregate %.

10 of 10 new or added lines in 1 file covered. (100.0%)

125 of 126 relevant lines covered (99.21%)

104.64 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

97.27

/lib/index.js

Build SHA Not Found

The commit SHA "086facd72814ac05beceebbe10197bf3899851f9" was not found in your repository, so the file cannot be loaded. This may be because you posted from a local development environment, or your CI created an ephemeral commit.

expressjs / cors / 164

Source File Press 'n' to go to next uncovered line, 'b' for previous

Build SHA Not Found

Source File
Press 'n' to go to next uncovered line, 'b' for previous