Skip to content

Commit

Permalink
feat: remove the 'origins' option
Browse files Browse the repository at this point in the history 
The underlying Engine.IO server now supports a 'cors' option, which
will be forwarded to the cors module.

Breaking change: the 'origins' option is removed

Before:

```js
new Server(3000, {
  origins: ["https://example.com"]
});
```

The 'origins' option was used in the allowRequest method, in order to
determine whether the request should pass or not. And the Engine.IO
server would implicitly add the necessary Access-Control-Allow-xxx
headers.

After:

```js
new Server(3000, {
  cors: {
    origin: "https://example.com",
    methods: ["GET", "POST"],
    allowedHeaders: ["content-type"]
  }
});
```

The already existing 'allowRequest' option can be used for validation:

```js
new Server(3000, {
  allowRequest: (req, callback) => {
    callback(null, req.headers.referer.startsWith("https://example.com"));
  }
});
```
  • Loading branch information
@darrachequesne
darrachequesne committed Oct 13, 2020
1 parent 8b6b100 commit a8c0600
Show file tree
Hide file tree
Showing 4 changed files with 34 additions and 234 deletions.
19 changes: 0 additions & 19 deletions dist/index.d.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -97,10 +97,6 @@ interface ServerOptions extends EngineAttachOptions {
* the adapter to use. Defaults to an instance of the Adapter that ships with socket.io which is memory based.
*/
adapter: any;
/**
* the allowed origins (*:*)
*/
origins: string | string[] | ((origin: string, cb: (err: Error, allow: boolean) => void) => void);
/**
* the parser to use. Defaults to an instance of the Parser that ships with socket.io.
*/
Expand All @@ -115,7 +111,6 @@ export declare class Server extends EventEmitter {
nsps: Map<string, Namespace>;
private parentNsps;
private _adapter;
private _origins;
private _serveClient;
private eio;
private engine;
Expand All @@ -130,13 +125,6 @@ export declare class Server extends EventEmitter {
constructor(opts?: Partial<ServerOptions>);
constructor(srv: http.Server, opts?: Partial<ServerOptions>);
constructor(srv: number, opts?: Partial<ServerOptions>);
/**
* Server request verification function, that checks for allowed origins
*
* @param {http.IncomingMessage} req request
* @param {Function} fn callback to be called with the result: `fn(err, success)`
*/
private checkRequest;
/**
* Sets/gets whether client code is being served.
*
Expand Down Expand Up @@ -168,13 +156,6 @@ export declare class Server extends EventEmitter {
* @return {Server|Adapter} self when setting or value when getting
*/
adapter(v: any): any;
/**
* Sets the allowed origins for requests.
*
* @param {String|String[]} v origins
* @return {Server|Adapter} self when setting or value when getting
*/
origins(v: any): any;
/**
* Attaches socket.io to a server or port.
*
Expand Down
47 changes: 0 additions & 47 deletions dist/index.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ const namespace_1 = require("./namespace");
const parent_namespace_1 = require("./parent-namespace");
const socket_io_adapter_1 = require("socket.io-adapter");
const parser = __importStar(require("socket.io-parser"));
const url_1 = __importDefault(require("url"));
const debug_1 = __importDefault(require("debug"));
const debug = debug_1.default("socket.io:server");
const clientVersion = require("socket.io-client/package.json").version;
Expand All @@ -56,42 +55,10 @@ class Server extends events_1.EventEmitter {
this.parser = opts.parser || parser;
this.encoder = new this.parser.Encoder();
this.adapter(opts.adapter || socket_io_adapter_1.Adapter);
this.origins(opts.origins || "*:*");
this.sockets = this.of("/");
if (srv)
this.attach(srv, opts);
}
/**
* Server request verification function, that checks for allowed origins
*
* @param {http.IncomingMessage} req request
* @param {Function} fn callback to be called with the result: `fn(err, success)`
*/
checkRequest(req, fn) {
let origin = req.headers.origin || req.headers.referer;
// file:// URLs produce a null Origin which can't be authorized via echo-back
if ("null" == origin || null == origin)
origin = "*";
if (!!origin && typeof this._origins == "function")
return this._origins(origin, fn);
if (this._origins.indexOf("*:*") !== -1)
return fn(null, true);
if (origin) {
try {
const parts = url_1.default.parse(origin);
const defaultPort = "https:" == parts.protocol ? 443 : 80;
parts.port = parts.port != null ? parts.port : defaultPort;
const ok = ~this._origins.indexOf(parts.protocol + "//" + parts.hostname + ":" + parts.port) ||
~this._origins.indexOf(parts.hostname + ":" + parts.port) ||
~this._origins.indexOf(parts.hostname + ":*") ||
~this._origins.indexOf("*:" + parts.port);
debug("origin %s is %svalid", origin, !!ok ? "" : "not ");
return fn(null, !!ok);
}
catch (ex) { }
}
fn(null, false);
}
/**
* Sets/gets whether client code is being served.
*
Expand Down Expand Up @@ -176,18 +143,6 @@ class Server extends events_1.EventEmitter {
}
return this;
}
/**
* Sets the allowed origins for requests.
*
* @param {String|String[]} v origins
* @return {Server|Adapter} self when setting or value when getting
*/
origins(v) {
if (!arguments.length)
return this._origins;
this._origins = v;
return this;
}
listen(srv, opts = {}) {
return this.attach(srv, opts);
}
Expand All @@ -212,8 +167,6 @@ class Server extends events_1.EventEmitter {
}
// set engine.io path to `/socket.io`
opts.path = opts.path || this._path;
// set origins verification
opts.allowRequest = opts.allowRequest || this.checkRequest.bind(this);
this.initEngine(srv, opts);
return this;
}
Expand Down
62 changes: 0 additions & 62 deletions lib/index.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ import { ParentNamespace } from "./parent-namespace";
import { Adapter, Room, SocketId } from "socket.io-adapter";
import * as parser from "socket.io-parser";
import { Encoder } from "socket.io-parser";
import url from "url";
import debugModule from "debug";
import { Socket } from "./socket";
import { CookieSerializeOptions } from "cookie";
Expand Down Expand Up @@ -122,13 +121,6 @@ interface ServerOptions extends EngineAttachOptions {
* the adapter to use. Defaults to an instance of the Adapter that ships with socket.io which is memory based.
*/
adapter: any;
/**
* the allowed origins (*:*)
*/
origins:
| string
| string[]
| ((origin: string, cb: (err: Error, allow: boolean) => void) => void);
/**
* the parser to use. Defaults to an instance of the Parser that ships with socket.io.
*/
Expand All @@ -155,7 +147,6 @@ export class Server extends EventEmitter {
ParentNamespace
> = new Map();
private _adapter;
private _origins;
private _serveClient: boolean;
private eio;
private engine;
Expand All @@ -182,48 +173,10 @@ export class Server extends EventEmitter {
this.parser = opts.parser || parser;
this.encoder = new this.parser.Encoder();
this.adapter(opts.adapter || Adapter);
this.origins(opts.origins || "*:*");
this.sockets = this.of("/");
if (srv) this.attach(srv, opts);
}

/**
* Server request verification function, that checks for allowed origins
*
* @param {http.IncomingMessage} req request
* @param {Function} fn callback to be called with the result: `fn(err, success)`
*/
private checkRequest(
req: http.IncomingMessage,
fn: (err: Error, success: boolean) => void
) {
let origin = req.headers.origin || req.headers.referer;

// file:// URLs produce a null Origin which can't be authorized via echo-back
if ("null" == origin || null == origin) origin = "*";

if (!!origin && typeof this._origins == "function")
return this._origins(origin, fn);
if (this._origins.indexOf("*:*") !== -1) return fn(null, true);
if (origin) {
try {
const parts: any = url.parse(origin);
const defaultPort = "https:" == parts.protocol ? 443 : 80;
parts.port = parts.port != null ? parts.port : defaultPort;
const ok =
~this._origins.indexOf(
parts.protocol + "//" + parts.hostname + ":" + parts.port
) ||
~this._origins.indexOf(parts.hostname + ":" + parts.port) ||
~this._origins.indexOf(parts.hostname + ":*") ||
~this._origins.indexOf("*:" + parts.port);
debug("origin %s is %svalid", origin, !!ok ? "" : "not ");
return fn(null, !!ok);
} catch (ex) {}
}
fn(null, false);
}

/**
* Sets/gets whether client code is being served.
*
Expand Down Expand Up @@ -319,19 +272,6 @@ export class Server extends EventEmitter {
return this;
}

/**
* Sets the allowed origins for requests.
*
* @param {String|String[]} v origins
* @return {Server|Adapter} self when setting or value when getting
*/
public origins(v) {
if (!arguments.length) return this._origins;

this._origins = v;
return this;
}

/**
* Attaches socket.io to a server or port.
*
Expand Down Expand Up @@ -379,8 +319,6 @@ export class Server extends EventEmitter {

// set engine.io path to `/socket.io`
opts.path = opts.path || this._path;
// set origins verification
opts.allowRequest = opts.allowRequest || this.checkRequest.bind(this);

this.initEngine(srv, opts);

Expand Down
Loading

0 comments on commit a8c0600

Please sign in to comment.