index.js
function _cors (cookieDomain, publicUrl) {
  return ({ acceptServers, acceptAllOrigins }) => {
    // accept server 2 server requests by default
    acceptServers = acceptServers === undefined ? true : acceptServers
    // do not accept call by outside origins by default
    acceptAllOrigins = acceptAllOrigins === undefined ? false : acceptAllOrigins
    return corsBuilder({
      credentials: true,
      origin (origin, callback) {
        // Case of server to server requests
        if (!origin) {
          if (acceptServers) return callback(null, true)
          return callback(new Error('No CORS allowed for server to server requests'))
        }

        // Case where we accept any domain as origin
        if (acceptAllOrigins) return callback(null, true)

        const originDomain = new URL(origin).host

        // Case of mono-domain acceptance
        if (!cookieDomain) {
          if (originDomain === new URL(publicUrl).host) return callback(null, true)
          return callback(new Error(`No CORS allowed from origin ${origin}`))
        }

        // Case of subdomains acceptance
        if (originDomain === cookieDomain || originDomain.endsWith('.' + cookieDomain)) {
          return callback(null, true)
        }
        callback(new Error(`No CORS allowed from origin ${origin}`))
      }
    })
  }
}
function _cors (cookieDomain, publicUrl) {
  return ({ acceptServers, acceptAllOrigins }) => {
    // accept server 2 server requests by default
    acceptServers = acceptServers === undefined ? true : acceptServers
    // do not accept call by outside origins by default
    acceptAllOrigins = acceptAllOrigins === undefined ? false : acceptAllOrigins
    return corsBuilder({
      credentials: true,
      origin (origin, callback) {
        // Case of server to server requests
        if (!origin) {
          if (acceptServers) return callback(null, true)
          return callback(new Error('No CORS allowed for server to server requests'))
        }

        // Case where we accept any domain as origin
        if (acceptAllOrigins) return callback(null, true)

        const originDomain = new URL(origin).host

        // Case of mono-domain acceptance
        if (!cookieDomain) {
          if (originDomain === new URL(publicUrl).host) return callback(null, true)
          return callback(new Error(`No CORS allowed from origin ${origin}`))
        }

        // Case of subdomains acceptance
        if (originDomain === cookieDomain || originDomain.endsWith('.' + cookieDomain)) {
          return callback(null, true)
        }
        callback(new Error(`No CORS allowed from origin ${origin}`))
      }
    })
  }
}
function _cors ( cookieDomain , publicUrl ) { return ( { acceptServers , acceptAllOrigins } ) => { // accept server 2 server requests by default acceptServers = acceptServers === undefined ? true : acceptServers // do not accept call by outside origins by default acceptAllOrigins = acceptAllOrigins === undefined ? false : acceptAllOrigins return corsBuilder ( { credentials : true , origin ( origin , callback ) { // Case of server to server requests if ( ! origin ) { if ( acceptServers ) return callback ( null , true ) return callback ( new Error ( 'No CORS allowed for server to server requests' ) ) } // Case where we accept any domain as origin if ( acceptAllOrigins ) return callback ( null , true ) const originDomain = new URL ( origin ) . host // Case of mono-domain acceptance if ( ! cookieDomain ) { if ( originDomain === new URL ( publicUrl ) . host ) return callback ( null , true ) return callback ( new Error ( ` ${ origin } ` ) ) } // Case of subdomains acceptance if ( originDomain === cookieDomain || originDomain . endsWith ( '.' + cookieDomain ) ) { return callback ( null , true ) } callback ( new Error ( ` ${ origin } ` ) ) } } ) } }
Return a function that can build a CORS middleware
Return a function that can build a CORS middleware