Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Add origin matching with wildcard subdomains for the upcoming allowedOrigins option

Fermée
  • Quelque chose ne va pas ?
#229 2 commentaires 0 réactions 1 personne assignée Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

@srikar-naidu y travaille déjà.

Depuis le 20/10/2026.

  • #258 par @srikar-naidu — fusionnée

Évaluation

Cette issue n'a pas encore été évaluée.

Description

enhancement good first issue hacktoberfest server

Today the server takes one cors string (packages/server/src/config.ts, line 20) and sends it back in Access-Control-Allow-Origin on every response. A site with a staging domain or several subdomains can't list them, and '*' lets any site embed your bot. The next release adds allowedOrigins: string[]. This issue is the matching logic, as pure functions in a new file; wiring it into the adapters comes later.

What to do
Create packages/server/src/security/origin.ts with:

/** Returns the allowed entry that matches, or null. */
export function matchOrigin(origin: string | null, allowed: string[]): string | null;

/** CORS headers for a response to `origin`. */
export function corsHeaders(origin: string | null, allowed: string[]): Record<string, string>;

Rules for matchOrigin:

  • '*' in the list matches any origin, including a missing one.
  • An exact entry like https://acme.com matches only that origin: same scheme, host and port. https://acme.com:8443 is a different origin.
  • https://*.acme.com matches https://app.acme.com and https://a.b.acme.com, but not https://acme.com itself, http://app.acme.com, or https://evilacme.com.
  • Compare case-insensitively and ignore a trailing slash in the config entry. The Origin header never has a path.
  • null, an empty string, or the literal string "null" (sandboxed iframes send it) match only '*'.

corsHeaders returns:

  • Access-Control-Allow-Origin: * when the match is '*', the request's origin when an entry matched, and no allow-origin header when nothing matched
  • always Vary: Origin, unless the list is just ['*'], so caches don't serve one site's answer to another

Where to look

  • packages/server/src/adapters/vercel.ts, lines 6 to 16, for how CORS headers are set today
  • The MDN page on Origin for the exact format

Acceptance criteria

  • New packages/server/src/security/origin.ts and packages/server/tests/security/origin.test.ts
  • A test for every rule above, including the evilacme.com, port and http cases
  • Not exported from @chatcops/server yet, and no changeset needed (pnpm changeset --empty)
  • pnpm test:coverage and pnpm lint pass

Want to work on this? Comment below and I'll assign it to you. Please take one issue at a time, branch off dev, and open your PR against dev with Closes #<this issue number>. Setup notes (pnpm, build before test) are in CONTRIBUTING.md.

Langage dominant
TypeScript
Étoiles
13
Forks
7
Merge moyen
3 h 28 min
PR mergées (30 j)
182

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de codercops/chatcops

Toutes les issues de codercops/chatcops

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.