jprdonnelly/freeCodeCamp
1
0
Fork 0
mirror of https://github.com/freeCodeCamp/freeCodeCamp.git synced 2026-03-31 18:01:36 -04:00
Code Issues Projects Releases Wiki Activity

feat(api): sync api and api-server CORS headers (#51608)

Browse Source
This commit is contained in:
Oliver Eyton-Williams
2023-09-21 15:40:19 +02:00
committed by GitHub
parent a3a58508bc
commit 2b5bc585a3
2 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
api/src/plugins/cors.ts
View File

@@ -3,8 +3,6 @@ import { FastifyPluginCallback } from 'fastify';
import fp from 'fastify-plugin';
import { HOME_LOCATION } from '../utils/env';
// import { FREECODECAMP_NODE_ENV } from '../utils/env';
const allowedOrigins = [
'https://www.freecodecamp.dev',
'https://www.freecodecamp.org',
@@ -34,9 +32,14 @@ const cors: FastifyPluginCallback = (fastify, _options, done) => {
void reply
.header(
'Access-Control-Allow-Headers',
'Origin, X-Requested-With, Content-Type, Accept'
'Origin, X-Requested-With, Content-Type, Accept, Csrf-Token'
)
.header('Access-Control-Allow-Credentials', true);
.header('Access-Control-Allow-Credentials', true)
// These 4 are the only methods we use
.header('Access-Control-Allow-Methods', 'GET, PUT, POST, DELETE')
// Vary: Origin to prevent cache poisoning
// TODO: do we need Vary: Accept-Encoding?
.header('Vary', 'Origin, Accept-Encoding');
});
done();

7
api/src/server.test.ts
View File

@@ -89,12 +89,13 @@ describe('server', () => {
});
});
test('should have Access-Control-Allow-(Headers+Credentials) headers', async () => {
test('should have CORS headers', async () => {
const res = await superRequest('/', { method: 'GET' });
expect(res.headers).toMatchObject({
'access-control-allow-headers':
'Origin, X-Requested-With, Content-Type, Accept',
'access-control-allow-credentials': 'true'
'Origin, X-Requested-With, Content-Type, Accept, Csrf-Token',
'access-control-allow-credentials': 'true',
'access-control-allow-methods': 'GET, PUT, POST, DELETE'
});
});
});