decentraland / atlas-server / 39782561064

94%

push

github

fix: always send the cors allow-origin header (#147)

## Cause
@dcl/http-server 2.x's CORS middleware only adds
`Access-Control-Allow-Origin` when the request carries `Origin`; express
`cors` in 1.5.2 always sent `*`. Responses are publicly cacheable
(`Cache-Control: public, s-maxage`), so a CDN can cache a response
without the header and break cross-origin browser fetches. The cors
config also used `method`, which the library ignores.

## Fix
- `allowAnyOriginMiddleware`
(`src/logic/allow-any-origin-middleware.ts`) sets
`Access-Control-Allow-Origin: *` on every response unless one is already
set; it is registered when `CORS_ORIGIN` is `*` or unset.
- `CORS_METHOD` is passed as `methods` (split on commas).

## Verification
- New unit spec for the middleware; `jest` 77/77, `tsc` clean.
- Against a real `@dcl/http-server` instance with this config: a request
without `Origin` now gets `Access-Control-Allow-Origin: *`; with
`Origin` and on preflight it is unchanged (`*`, preflight
`Access-Control-Allow-Methods: *`).

313 of 432 branches covered (72.45%)

Branch coverage included in aggregate %.

71 of 84 new or added lines in 2 files covered. (84.52%)

1559 of 3969 relevant lines covered (39.28%)

11.85 hits per line