Customize access-control-allow-origin headers in order to set specific origin domains

未关闭
  • 哪里不对？
#809 3 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
35/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
停滞
技术栈
javascript
领域
backend, cli, security

调研方向

首先跟踪 --cors 选项的解析方式，以及 access-control-allow-origin 响应标头的设置位置。在决定应如何表示可配置的 origin 之前，先检查现有的 CORS 行为及其文档。完成的标准是允许指定的域名或 *，同时保持带凭据请求的正确行为。

由索引模型根据 Issue 内容生成。

描述

stale
What's the problem this feature will solve?

Currently, with --cors enabled access-control-allow-origin hard coded to *. If http-server is behind features that require authentication (client SSL certs in my case), the fetch spec requires browsers to validate that the requesting server be set as an allowed origin. So when server1 makes a request to server2 it fails because of the wildcard. This is the intended behavior as designed. Firefox currently (correctly) follows the fetch spec but, Chrome and Edge do not. At some point, chrome and edge 'should' eventually be fixed.

Chrome and Edge still send certs unprompted when executing the fetch command, but when fetch is set to {credentials:"include"} in server1 requesting information from server2 you now get this error:

Access to fetch at 'https://server2.tld' from origin 'https://server1.tld' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

Describe the solution you'd like

Requesting the ability to customize access-control-allow-origin headers in order to pass specific domains or set * manually.

This will allow http-server to be used correctly with authentication when a fetch is set to { credentials:"include" } .

Alternative Solutions
When requesting server does not have fetch is set to { credentials:"include" }
  • Firefox: in about:config set network.cors_preflight.allow_client_cert to true. Otherwise browser fails preflight because certs are not passed.
  • Chrome: in chrome://flags set Omit TLS client certificates if credential mode disallows to disabled. This is also the default behavior, chrome automatically sends credentials, this is against the spec.
  • Edge: no changes, flags are not available for this setting (default behavior, edge automatically sends credentials, this is against the spec.
When fetch is set to { credentials:"include" } on server1

Fails on all browsers

Access to fetch at 'https://server2.tld' from origin 'https://server1.tld' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

Alternate hack

Modify http-server source locally to hard code for my specific use-case, replace access-control-allow-origin = '*' and hard code it to access-control-allow-origin = 'https://server1.tld so it works for me. then enable --cors, start http-server.

Additional context

I'm sure there are other use-cases for setting access-control-allow-origin to custom domains, but for the authentication issue with client SSL certs, it's a must have.

I am aware that solution #760 to issue #729 can potentially fix my problem, but automatically mirroring the origin server will allow any origin to pass credentials, which is not very safe. This fix should only be used for testing and not production.

主要语言
JavaScript
星标
14.2k
派生
1.6k
30 天内没有已合并 PR

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

http-party/http-server 的其他 Issue

查看 http-party/http-server 的全部 Issue

相似的 Issue

更多 JavaScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。