xiaoxue_admin
/
RSSHub
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(core): set access-control-allow-origin header to prevent abuse

This commit is contained in:
DIYgod 2019-04-30 00:12:28 +08:00
parent 63505fdafc
commit 8637eb06d2
No known key found for this signature in database
GPG Key ID: EC0B76A252D3EF67
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/middleware/header.js
View File

@ -2,8 +2,6 @@ const etagCalculate = require('etag');
const logger = require('../utils/logger');
const config = require('../config');
const headers = {
'Access-Control-Allow-Origin': '*',
'Access-Control-Allow-Headers': 'Content-Type, Content-Length, Authorization, Accept, X-Requested-With',
'Access-Control-Allow-Methods': 'GET',
'Content-Type': 'application/xml; charset=utf-8',
'Cache-Control': `public, max-age=${config.cacheExpire}`,
@ -12,6 +10,9 @@ const headers = {
module.exports = async (ctx, next) => {
logger.info(`${ctx.url}, user IP: ${ctx.ips[0] || ctx.ip}`);
ctx.set(headers);
ctx.set({
'Access-Control-Allow-Origin': `${ctx.host}`,
});
await next();

2
test/middleware/header.js
View File

@ -10,7 +10,7 @@ afterAll(() => {
describe('header', () => {
it(`header`, async () => {
const response = await request.get('/test/1');
expect(response.headers['access-control-allow-origin']).toBe('*');
expect(response.headers['access-control-allow-origin']).toBe('127.0.0.1:1200');
expect(response.headers['access-control-allow-headers']).toBe('Content-Type, Content-Length, Authorization, Accept, X-Requested-With');
expect(response.headers['access-control-allow-methods']).toBe('GET');
expect(response.headers['content-type']).toBe('application/xml; charset=utf-8');