16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
117 lines
2.3 KiB
Plaintext
117 lines
2.3 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
https://nodejs.org/api/http.html[nodejs http] built-in module:
|
|
|
|
[source,javascript]
|
|
----
|
|
const http = require('http');
|
|
const srv = http.createServer((req, res) => {
|
|
res.writeHead(200, { 'Access-Control-Allow-Origin': '*' }); // Sensitive
|
|
res.end('ok');
|
|
});
|
|
srv.listen(3000);
|
|
----
|
|
|
|
https://www.npmjs.com/package/express[Express.js] framework with https://www.npmjs.com/package/cors[cors middleware]:
|
|
|
|
[source,javascript]
|
|
----
|
|
const cors = require('cors');
|
|
|
|
let app1 = express();
|
|
app1.use(cors()); // Sensitive: by default origin is set to *
|
|
|
|
let corsOptions = {
|
|
origin: '*' // Sensitive
|
|
};
|
|
|
|
let app2 = express();
|
|
app2.use(cors(corsOptions));
|
|
----
|
|
|
|
User-controlled origin:
|
|
|
|
[source,javascript]
|
|
----
|
|
function (req, res) {
|
|
const origin = req.header('Origin');
|
|
res.setHeader('Access-Control-Allow-Origin', origin); // Sensitive
|
|
};
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
https://nodejs.org/api/http.html[nodejs http] built-in module:
|
|
|
|
[source,javascript]
|
|
----
|
|
const http = require('http');
|
|
const srv = http.createServer((req, res) => {
|
|
res.writeHead(200, { 'Access-Control-Allow-Origin': 'trustedwebsite.com' }); // Compliant
|
|
res.end('ok');
|
|
});
|
|
srv.listen(3000);
|
|
----
|
|
|
|
https://www.npmjs.com/package/express[Express.js] framework with https://www.npmjs.com/package/cors[cors middleware]:
|
|
|
|
[source,javascript]
|
|
----
|
|
const cors = require('cors');
|
|
|
|
let corsOptions = {
|
|
origin: 'trustedwebsite.com' // Compliant
|
|
};
|
|
|
|
let app = express();
|
|
app.use(cors(corsOptions));
|
|
----
|
|
|
|
User-controlled origin validated with an allow-list:
|
|
|
|
[source,javascript]
|
|
----
|
|
function (req, res) {
|
|
const origin = req.header('Origin');
|
|
|
|
if (trustedOrigins.indexOf(origin) >= 0) {
|
|
res.setHeader('Access-Control-Allow-Origin', origin);
|
|
}
|
|
};
|
|
----
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
include::../highlighting.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== on 6 Jan 2019, 17:05:39 Lars Svensson wrote:
|
|
https://nodejs.org/api/http.html
|
|
|
|
https://nodejs.org/api/https.html
|
|
|
|
https://expressjs.com/en/4x/api.html
|
|
|
|
https://www.npmjs.com/package/cors
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|