Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

Add origin matching with wildcard subdomains for the upcoming allowedOrigins option

Fechada
  • Algo errado?
#229 2 comentários 0 reações 1 responsável Ver no GitHub

Mantenedores costumam responder em até 1 dia

@srikar-naidu já está trabalhando nisso.

Desde 20/10/2026.

  • #258 de @srikar-naidu — integrado

Avaliação

Esta issue ainda não foi avaliada.

Descrição

enhancement good first issue hacktoberfest server

Today the server takes one cors string (packages/server/src/config.ts, line 20) and sends it back in Access-Control-Allow-Origin on every response. A site with a staging domain or several subdomains can't list them, and '*' lets any site embed your bot. The next release adds allowedOrigins: string[]. This issue is the matching logic, as pure functions in a new file; wiring it into the adapters comes later.

What to do
Create packages/server/src/security/origin.ts with:

/** Returns the allowed entry that matches, or null. */
export function matchOrigin(origin: string | null, allowed: string[]): string | null;

/** CORS headers for a response to `origin`. */
export function corsHeaders(origin: string | null, allowed: string[]): Record<string, string>;

Rules for matchOrigin:

  • '*' in the list matches any origin, including a missing one.
  • An exact entry like https://acme.com matches only that origin: same scheme, host and port. https://acme.com:8443 is a different origin.
  • https://*.acme.com matches https://app.acme.com and https://a.b.acme.com, but not https://acme.com itself, http://app.acme.com, or https://evilacme.com.
  • Compare case-insensitively and ignore a trailing slash in the config entry. The Origin header never has a path.
  • null, an empty string, or the literal string "null" (sandboxed iframes send it) match only '*'.

corsHeaders returns:

  • Access-Control-Allow-Origin: * when the match is '*', the request's origin when an entry matched, and no allow-origin header when nothing matched
  • always Vary: Origin, unless the list is just ['*'], so caches don't serve one site's answer to another

Where to look

  • packages/server/src/adapters/vercel.ts, lines 6 to 16, for how CORS headers are set today
  • The MDN page on Origin for the exact format

Acceptance criteria

  • New packages/server/src/security/origin.ts and packages/server/tests/security/origin.test.ts
  • A test for every rule above, including the evilacme.com, port and http cases
  • Not exported from @chatcops/server yet, and no changeset needed (pnpm changeset --empty)
  • pnpm test:coverage and pnpm lint pass

Want to work on this? Comment below and I'll assign it to you. Please take one issue at a time, branch off dev, and open your PR against dev with Closes #<this issue number>. Setup notes (pnpm, build before test) are in CONTRIBUTING.md.

Linguagem predominante
TypeScript
Estrelas
13
Forks
7
Merge médio
3h 41min
PRs com merge (30d)
155

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de codercops/chatcops

Todas as issues de codercops/chatcops

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.