Skip to content

Commit ec4e12a

Browse files
darrachequesnedarrachequesne
committed
[revert] Allow configuration of Access-Control-Allow-Origin value (#511)
This reverts commit ebf1a96. Related: #3381
1 parent 64d6044 commit ec4e12a

File tree

9 files changed

+32
-42
lines changed

9 files changed

+32
-42
lines changed

‎README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,6 @@ to a single process.
228228
- `maxHttpBufferSize` (`Number`): how many bytes or characters a message
229229
can be, before closing the session (to avoid DoS). Default
230230
value is `10E7`.
231-
- `origins` (`String`): the allowed origins (`*`)
232231
- `allowRequest` (`Function`): A function that receives a given handshake
233232
or upgrade request as its first parameter, and can decide whether to
234233
continue or not. The second argument is a function that needs to be

‎lib/server.js

Lines changed: 9 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ function Server (opts) {
4545
this.allowUpgrades = false !== opts.allowUpgrades;
4646
this.allowRequest = opts.allowRequest;
4747
this.cookie = false !== opts.cookie ? (opts.cookie || 'io') : false;
48-
this.origins = opts.origins || '*';
4948
this.cookiePath = false !== opts.cookiePath ? (opts.cookiePath || '/') : false;
5049
this.cookieHttpOnly = false !== opts.cookieHttpOnly;
5150
this.perMessageDeflate = false !== opts.perMessageDeflate ? (opts.perMessageDeflate || true) : false;
@@ -222,7 +221,7 @@ Server.prototype.handleRequest = function (req, res) {
222221
var self = this;
223222
this.verify(req, false, function (err, success) {
224223
if (!success) {
225-
self.sendErrorMessage(req, res, err);
224+
sendErrorMessage(req, res, err);
226225
return;
227226
}
228227

@@ -243,7 +242,7 @@ Server.prototype.handleRequest = function (req, res) {
243242
* @api private
244243
*/
245244

246-
Server.prototype.sendErrorMessage = function (req, res, code) {
245+
function sendErrorMessage (req, res, code) {
247246
var headers = { 'Content-Type': 'application/json' };
248247

249248
var isForbidden = !Server.errorMessages.hasOwnProperty(code);
@@ -255,21 +254,20 @@ Server.prototype.sendErrorMessage = function (req, res, code) {
255254
}));
256255
return;
257256
}
258-
259-
headers['Access-Control-Allow-Origin'] = this.origins;
260-
headers['Vary'] = 'Origin';
261257
if (req.headers.origin) {
262258
headers['Access-Control-Allow-Credentials'] = 'true';
259+
headers['Access-Control-Allow-Origin'] = req.headers.origin;
260+
} else {
261+
headers['Access-Control-Allow-Origin'] = '*';
263262
}
264-
265263
if (res !== undefined) {
266264
res.writeHead(400, headers);
267265
res.end(JSON.stringify({
268266
code: code,
269267
message: Server.errorMessages[code]
270268
}));
271269
}
272-
};
270+
}
273271

274272
/**
275273
* generate a socket id.
@@ -295,12 +293,9 @@ Server.prototype.handshake = function (transportName, req) {
295293
var id = this.generateId(req);
296294

297295
debug('handshaking client "%s"', id);
298-
var opts = {
299-
origins: this.origins
300-
};
301296

302297
try {
303-
var transport = new transports[transportName](req, opts);
298+
var transport = new transports[transportName](req);
304299
if ('polling' === transportName) {
305300
transport.maxHttpBufferSize = this.maxHttpBufferSize;
306301
transport.httpCompression = this.httpCompression;
@@ -314,7 +309,7 @@ Server.prototype.handshake = function (transportName, req) {
314309
transport.supportsBinary = true;
315310
}
316311
} catch (e) {
317-
this.sendErrorMessage(req, req.res, Server.errors.BAD_REQUEST);
312+
sendErrorMessage(req, req.res, Server.errors.BAD_REQUEST);
318313
return;
319314
}
320315
var socket = new Socket(id, this, transport, req);
@@ -408,10 +403,7 @@ Server.prototype.onWebSocket = function (req, socket) {
408403
// transport error handling takes over
409404
socket.removeListener('error', onUpgradeError);
410405

411-
var opts = {
412-
origins: this.origins
413-
};
414-
var transport = new transports[req._query.transport](req, opts);
406+
var transport = new transports[req._query.transport](req);
415407
if (req._query && req._query.b64) {
416408
transport.supportsBinary = false;
417409
} else {

‎lib/transport.js

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,12 @@ function noop () {}
2626
* Transport constructor.
2727
*
2828
* @param {http.IncomingMessage} request
29-
* @param {Object} opts allows the origins option to be passed along
3029
* @api public
3130
*/
3231

33-
function Transport (req, opts) {
32+
function Transport (req) {
3433
this.readyState = 'open';
3534
this.discarded = false;
36-
this.origins = opts.origins;
3735
}
3836

3937
/**

‎lib/transports/index.js

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ exports.polling.upgradesTo = ['websocket'];
2727
* @api private
2828
*/
2929

30-
function polling (req, opts) {
30+
function polling (req) {
3131
if ('string' === typeof req._query.j) {
32-
return new JSONP(req, opts);
32+
return new JSONP(req);
3333
} else {
34-
return new XHR(req, opts);
34+
return new XHR(req);
3535
}
3636
}

‎lib/transports/polling-jsonp.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ module.exports = JSONP;
2121
* @api public
2222
*/
2323

24-
function JSONP (req, opts) {
25-
Polling.call(this, req, opts);
24+
function JSONP (req) {
25+
Polling.call(this, req);
2626

2727
this.head = '___eio[' + (req._query.j || '').replace(/[^0-9]/g, '') + '](';
2828
this.foot = ');';

‎lib/transports/polling-xhr.js

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ module.exports = XHR;
1818
* @api public
1919
*/
2020

21-
function XHR (req, opts) {
22-
Polling.call(this, req, opts);
21+
function XHR (req) {
22+
Polling.call(this, req);
2323
}
2424

2525
/**
@@ -58,10 +58,11 @@ XHR.prototype.onRequest = function (req) {
5858
XHR.prototype.headers = function (req, headers) {
5959
headers = headers || {};
6060

61-
headers['Access-Control-Allow-Origin'] = this.origins;
62-
headers['Vary'] = 'Origin';
6361
if (req.headers.origin) {
6462
headers['Access-Control-Allow-Credentials'] = 'true';
63+
headers['Access-Control-Allow-Origin'] = req.headers.origin;
64+
} else {
65+
headers['Access-Control-Allow-Origin'] = '*';
6566
}
6667

6768
return Polling.prototype.headers.call(this, req, headers);

‎lib/transports/polling.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ module.exports = Polling;
2727
* @api public.
2828
*/
2929

30-
function Polling (req, opts) {
31-
Transport.call(this, req, opts);
30+
function Polling (req) {
31+
Transport.call(this, req);
3232

3333
this.closeTimeout = 30 * 1000;
3434
this.maxHttpBufferSize = null;

‎lib/transports/websocket.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ module.exports = WebSocket;
2121
* @api public
2222
*/
2323

24-
function WebSocket (req, opts) {
25-
Transport.call(this, req, opts);
24+
function WebSocket (req) {
25+
Transport.call(this, req);
2626
var self = this;
2727
this.socket = req.websocket;
2828
this.socket.on('message', this.onData.bind(this));

‎test/server.js

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ describe('server', function () {
5858
expect(res.body.code).to.be(0);
5959
expect(res.body.message).to.be('Transport unknown');
6060
expect(res.header['access-control-allow-credentials']).to.be('true');
61-
expect(res.header['access-control-allow-origin']).to.be('*');
61+
expect(res.header['access-control-allow-origin']).to.be('http://engine.io');
6262
done();
6363
});
6464
});
@@ -75,7 +75,7 @@ describe('server', function () {
7575
expect(res.body.code).to.be(1);
7676
expect(res.body.message).to.be('Session ID unknown');
7777
expect(res.header['access-control-allow-credentials']).to.be('true');
78-
expect(res.header['access-control-allow-origin']).to.be('*');
78+
expect(res.header['access-control-allow-origin']).to.be('http://engine.io');
7979
done();
8080
});
8181
});
@@ -416,7 +416,7 @@ describe('server', function () {
416416
expect(res.body.code).to.be(3);
417417
expect(res.body.message).to.be('Bad request');
418418
expect(res.header['access-control-allow-credentials']).to.be('true');
419-
expect(res.header['access-control-allow-origin']).to.be('*');
419+
expect(res.header['access-control-allow-origin']).to.be('http://engine.io');
420420
done();
421421
});
422422
});
@@ -932,7 +932,7 @@ describe('server', function () {
932932
it('should trigger transport close before open for ws', function (done) {
933933
var opts = { transports: ['websocket'] };
934934
listen(opts, function (port) {
935-
var url = 'ws://%s:%d'.s('0.0.0.0', port);
935+
var url = 'ws://%s:%d'.s('0.0.0.50', port);
936936
var socket = new eioc.Socket(url);
937937
socket.on('open', function () {
938938
done(new Error('Test invalidation'));
@@ -2589,7 +2589,7 @@ describe('server', function () {
25892589

25902590
describe('cors', function () {
25912591
it('should handle OPTIONS requests', function (done) {
2592-
listen({handlePreflightRequest: true, origins: 'engine.io:*'}, function (port) {
2592+
listen({handlePreflightRequest: true}, function (port) {
25932593
request.options('http://localhost:%d/engine.io/default/'.s(port))
25942594
.set('Origin', 'http://engine.io')
25952595
.query({ transport: 'polling' })
@@ -2599,7 +2599,7 @@ describe('server', function () {
25992599
expect(res.body.code).to.be(2);
26002600
expect(res.body.message).to.be('Bad handshake method');
26012601
expect(res.header['access-control-allow-credentials']).to.be('true');
2602-
expect(res.header['access-control-allow-origin']).to.be('engine.io:*');
2602+
expect(res.header['access-control-allow-origin']).to.be('http://engine.io');
26032603
done();
26042604
});
26052605
});
@@ -2624,7 +2624,7 @@ describe('server', function () {
26242624
var headers = {};
26252625
if (req.headers.origin) {
26262626
headers['Access-Control-Allow-Credentials'] = 'true';
2627-
headers['Access-Control-Allow-Origin'] = '*';
2627+
headers['Access-Control-Allow-Origin'] = req.headers.origin;
26282628
} else {
26292629
headers['Access-Control-Allow-Origin'] = '*';
26302630
}
@@ -2642,7 +2642,7 @@ describe('server', function () {
26422642
expect(res.status).to.be(200);
26432643
expect(res.body).to.be.empty();
26442644
expect(res.header['access-control-allow-credentials']).to.be('true');
2645-
expect(res.header['access-control-allow-origin']).to.be('*');
2645+
expect(res.header['access-control-allow-origin']).to.be('http://engine.io');
26462646
expect(res.header['access-control-allow-methods']).to.be('GET,HEAD,PUT,PATCH,POST,DELETE');
26472647
expect(res.header['access-control-allow-headers']).to.be('origin, content-type, accept');
26482648
done();

0 commit comments

Comments
 (0)