Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Add origin matching with wildcard subdomains for the upcoming allowedOrigins option

Geschlossen
  • Stimmt etwas nicht?
#229 2 Kommentare 0 Reaktionen 1 zugewiesene Person Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

@srikar-naidu arbeitet bereits daran.

Seit 20.10.2026.

  • #258 von @srikar-naidu — gemerged

Bewertung

Dieses Issue wurde noch nicht bewertet.

Beschreibung

enhancement good first issue hacktoberfest server

Today the server takes one cors string (packages/server/src/config.ts, line 20) and sends it back in Access-Control-Allow-Origin on every response. A site with a staging domain or several subdomains can't list them, and '*' lets any site embed your bot. The next release adds allowedOrigins: string[]. This issue is the matching logic, as pure functions in a new file; wiring it into the adapters comes later.

What to do
Create packages/server/src/security/origin.ts with:

/** Returns the allowed entry that matches, or null. */
export function matchOrigin(origin: string | null, allowed: string[]): string | null;

/** CORS headers for a response to `origin`. */
export function corsHeaders(origin: string | null, allowed: string[]): Record<string, string>;

Rules for matchOrigin:

  • '*' in the list matches any origin, including a missing one.
  • An exact entry like https://acme.com matches only that origin: same scheme, host and port. https://acme.com:8443 is a different origin.
  • https://*.acme.com matches https://app.acme.com and https://a.b.acme.com, but not https://acme.com itself, http://app.acme.com, or https://evilacme.com.
  • Compare case-insensitively and ignore a trailing slash in the config entry. The Origin header never has a path.
  • null, an empty string, or the literal string "null" (sandboxed iframes send it) match only '*'.

corsHeaders returns:

  • Access-Control-Allow-Origin: * when the match is '*', the request's origin when an entry matched, and no allow-origin header when nothing matched
  • always Vary: Origin, unless the list is just ['*'], so caches don't serve one site's answer to another

Where to look

  • packages/server/src/adapters/vercel.ts, lines 6 to 16, for how CORS headers are set today
  • The MDN page on Origin for the exact format

Acceptance criteria

  • New packages/server/src/security/origin.ts and packages/server/tests/security/origin.test.ts
  • A test for every rule above, including the evilacme.com, port and http cases
  • Not exported from @chatcops/server yet, and no changeset needed (pnpm changeset --empty)
  • pnpm test:coverage and pnpm lint pass

Want to work on this? Comment below and I'll assign it to you. Please take one issue at a time, branch off dev, and open your PR against dev with Closes #<this issue number>. Setup notes (pnpm, build before test) are in CONTRIBUTING.md.

Vorherrschende Sprache
TypeScript
Sterne
13
Forks
7
Ø Merge
3 Std. 41 Min.
Gemergte PRs (30 T.)
155

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus codercops/chatcops

Alle Issues in codercops/chatcops

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.