TryGhost/Ghost
1
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2024-12-24 19:33:02 +03:00
Code Issues Projects Releases Wiki Activity

Added Vary value for CORS in Frontend

Browse Source 
refs https://github.com/TryGhost/Toolbox/issues/461

- Having a 'Origin' in vary header value present on each `OPTIONS` allows to correctly bucket "allowed CORS" and "disallowed CORS" responses in shared caches
This commit is contained in:
Naz 2022-11-02 16:20:15 +08:00
parent f581e33400
commit a8ba8cc444
No known key found for this signature in database
3 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
ghost/core/core/frontend/web/middleware/cors.js
View File

@ -54,4 +54,19 @@ function corsOptionsDelegate(req, callback) {
callback(null, corsOptions);
}
module.exports = cors(corsOptionsDelegate);
/**
*
* @param {Express.Request} req
* @param {Express.Response} res
* @param {Function} next
*/
const handleCaching = (req, res, next) => {
// @NOTE: try to add native support for dynamic 'vary' header value in 'cors' module
res.vary('Origin');
next();
};
module.exports = [
cors(corsOptionsDelegate),
handleCaching
];

2
ghost/core/core/server/web/api/middleware/cors.js
View File

@ -82,7 +82,7 @@ function corsOptionsDelegate(req, cb) {
}
/**
*
*
* @param {Express.Request} req
* @param {Express.Response} res
* @param {Function} next

4
ghost/core/test/e2e-server/1-options-requests.test.js
View File

@ -108,7 +108,7 @@ describe('OPTIONS requests', function () {
.expect(200);
assert.equal(res.headers['cache-control'], 'public, max-age=0');
assert.equal(res.headers.vary, 'Accept-Encoding');
assert.equal(res.headers.vary, 'Origin, Accept-Encoding');
assert.equal(res.headers.allow, 'POST,GET,HEAD');
});
@ -119,7 +119,7 @@ describe('OPTIONS requests', function () {
.expect(200);
assert.equal(res.headers['cache-control'], 'public, max-age=0');
assert.equal(res.headers.vary, 'Accept-Encoding');
assert.equal(res.headers.vary, 'Origin, Accept-Encoding');
assert.equal(res.headers.allow, 'POST,GET,HEAD');
});
});