public-offering
/
pad.pub0.org
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

openapi: disable cors headers for /api/** paths 

Still enabled for /rest/** and **/openapi.json
pull/3851/head
Viljami Kuosmanen 2020-03-30 03:52:25 +02:00 committed by muxator
parent 6aa30f213a
commit 3742fdfb04
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/node/hooks/express/openapi.js
View File

@ -556,6 +556,7 @@ exports.expressCreateServer = async (_, args) => {
// serve version specific openapi definition
app.get(`${apiRoot}/openapi.json`, (req, res) => {
// For openapi definitions, wide CORS is probably fine
res.header('Access-Control-Allow-Origin', '*');
res.json({ ...definition, servers: [generateServerForApiVersion(apiRoot, req)] });
});
@ -640,8 +641,11 @@ exports.expressCreateServer = async (_, args) => {
api.init();
app.use(apiRoot, async (req, res) => {
try {
// allow cors
res.header('Access-Control-Allow-Origin', '*');
if (style === APIPathStyle.REST) {
// @TODO: Don't allow CORS from everywhere
// This is purely to maintain compatibility with old swagger-node-express
res.header('Access-Control-Allow-Origin', '*');
}
await api.handleRequest(req, req, res);
} catch (err) {
if (err.name == 'apierror') {