Add origin matching with wildcard subdomains for the upcoming allowedOrigins option
维护者通常 1 天内回复
评估
这个 Issue 还没有评估数据。
描述
Today the server takes one cors string (packages/server/src/config.ts, line 20) and sends it back in Access-Control-Allow-Origin on every response. A site with a staging domain or several subdomains can't list them, and '*' lets any site embed your bot. The next release adds allowedOrigins: string[]. This issue is the matching logic, as pure functions in a new file; wiring it into the adapters comes later.
What to do
Create packages/server/src/security/origin.ts with:
/** Returns the allowed entry that matches, or null. */
export function matchOrigin(origin: string | null, allowed: string[]): string | null;
/** CORS headers for a response to `origin`. */
export function corsHeaders(origin: string | null, allowed: string[]): Record<string, string>;
Rules for matchOrigin:
'*'in the list matches any origin, including a missing one.- An exact entry like
https://acme.commatches only that origin: same scheme, host and port.https://acme.com:8443is a different origin. https://*.acme.commatcheshttps://app.acme.comandhttps://a.b.acme.com, but nothttps://acme.comitself,http://app.acme.com, orhttps://evilacme.com.- Compare case-insensitively and ignore a trailing slash in the config entry. The
Originheader never has a path. null, an empty string, or the literal string"null"(sandboxed iframes send it) match only'*'.
corsHeaders returns:
Access-Control-Allow-Origin: *when the match is'*', the request's origin when an entry matched, and no allow-origin header when nothing matched- always
Vary: Origin, unless the list is just['*'], so caches don't serve one site's answer to another
Where to look
packages/server/src/adapters/vercel.ts, lines 6 to 16, for how CORS headers are set today- The MDN page on Origin for the exact format
Acceptance criteria
- New
packages/server/src/security/origin.tsandpackages/server/tests/security/origin.test.ts - A test for every rule above, including the
evilacme.com, port andhttpcases - Not exported from
@chatcops/serveryet, and no changeset needed (pnpm changeset --empty) -
pnpm test:coverageandpnpm lintpass
Want to work on this? Comment below and I'll assign it to you. Please take one issue at a time, branch off dev, and open your PR against dev with Closes #<this issue number>. Setup notes (pnpm, build before test) are in CONTRIBUTING.md.
- 主要语言
- TypeScript
- 星标
- 13
- 派生
- 7
- 平均合并
- 3 小时 28 分钟
- 30 天内合并 PR
- 182
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
codercops/chatcops 的其他 Issue
-
Type-check the TypeScript samples in the docs可能已有人在做 @An16og 于 2 天前认领。 未关闭documentation hacktoberfest help wanted testing
难度 4/5 3-5 天 新手友好度 70/100
codercops/chatcops#201 · 7 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
-
hacktoberfest
难度 1/5 1 小时以内 新手友好度 35/100
维护者通常 1 天内回复
-
Add built-in translations to the widget可能已有人在做 @piyusshhjangid 于 1 天前认领。 未关闭help wanted widget
难度 4/5 3-5 天 新手友好度 52/100
codercops/chatcops#55 · 3 条评论 ·
维护者通常 1 天内回复
查看 codercops/chatcops 的全部 Issue
相似的 Issue
-
clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro impact:ux-friction issue-rating: 🦞 diamond lobster no-stale P3
难度 2/5 1-3 小时 新手友好度 73/100
openclaw/openclaw#182077 · 1 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
-
aikido high security
难度 2/5 1-3 小时 新手友好度 75/100
dequelabs/axe-linter-action#161 ·
-
[Feature Request] Update the DimCode agent icon to the 45:32 brand mark可能已有人在做 @eric8810 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 66/100
lyswhut/lx-music-desktop#3026 ·
-
难度 2/5 1-3 小时 新手友好度 76/100
abhigyanpatwari/GitNexus#3704 ·
维护者通常 1 天内回复