Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Add origin matching with wildcard subdomains for the upcoming allowedOrigins option

Abierto
  • ¿Algo no está bien?
#229 2 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@srikar-naidu ya está trabajando en esto.

Desde el 20/10/2026.

  • #258 de @srikar-naidu — abierto

Evaluación

Este issue todavía no se ha evaluado.

Descripción

enhancement good first issue hacktoberfest server

Today the server takes one cors string (packages/server/src/config.ts, line 20) and sends it back in Access-Control-Allow-Origin on every response. A site with a staging domain or several subdomains can't list them, and '*' lets any site embed your bot. The next release adds allowedOrigins: string[]. This issue is the matching logic, as pure functions in a new file; wiring it into the adapters comes later.

What to do
Create packages/server/src/security/origin.ts with:

/** Returns the allowed entry that matches, or null. */
export function matchOrigin(origin: string | null, allowed: string[]): string | null;

/** CORS headers for a response to `origin`. */
export function corsHeaders(origin: string | null, allowed: string[]): Record<string, string>;

Rules for matchOrigin:

  • '*' in the list matches any origin, including a missing one.
  • An exact entry like https://acme.com matches only that origin: same scheme, host and port. https://acme.com:8443 is a different origin.
  • https://*.acme.com matches https://app.acme.com and https://a.b.acme.com, but not https://acme.com itself, http://app.acme.com, or https://evilacme.com.
  • Compare case-insensitively and ignore a trailing slash in the config entry. The Origin header never has a path.
  • null, an empty string, or the literal string "null" (sandboxed iframes send it) match only '*'.

corsHeaders returns:

  • Access-Control-Allow-Origin: * when the match is '*', the request's origin when an entry matched, and no allow-origin header when nothing matched
  • always Vary: Origin, unless the list is just ['*'], so caches don't serve one site's answer to another

Where to look

  • packages/server/src/adapters/vercel.ts, lines 6 to 16, for how CORS headers are set today
  • The MDN page on Origin for the exact format

Acceptance criteria

  • New packages/server/src/security/origin.ts and packages/server/tests/security/origin.test.ts
  • A test for every rule above, including the evilacme.com, port and http cases
  • Not exported from @chatcops/server yet, and no changeset needed (pnpm changeset --empty)
  • pnpm test:coverage and pnpm lint pass

Want to work on this? Comment below and I'll assign it to you. Please take one issue at a time, branch off dev, and open your PR against dev with Closes #<this issue number>. Setup notes (pnpm, build before test) are in CONTRIBUTING.md.

Lenguaje dominante
TypeScript
Estrellas
13
Forks
7
Merge medio
4 h 11 min
PR fusionados (30 d)
122

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de codercops/chatcops

Todos los issues de codercops/chatcops

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.