
Security News
Open Source Maintainers Demand Ability to Block Copilot-Generated Issues and PRs
Open source maintainers are urging GitHub to let them block Copilot from submitting AI-generated issues and pull requests to their repositories.
access-control
Advanced tools
access-control
implements HTTP Access Control, which more commonly known as
CORS according to the W3 specification. The code is dead simple, easy to
understand and therefor also easy to contribute to. access-control
comes with
a really simple API, so it's super simple, super awesome, super stable. All you
expect from a small building block module as this.
npm install --save access-control
The module must first be configured before it can be used to add the correct CORS information to your HTTP requests. This is done by suppling the module with options.
'use strict';
var access = require('access-control');
After requiring the module you can supply the returned function with an options object which can contain the following properties:
*
which
will allow every origin.
true
(which is also the default value) in
combination with the origins
option to set to *
we
will automatically change the Access-Control-Allow-Origin
header to the sent Origin
header. As *
as origin
in combination with true
as value is not allowed by the
specification.
OPTIONS
request. The value can be set in numbers or a human
readable string which we will parse with the ms module. We
default to 30 days.
var cors = access({
maxAge: '1 hour',
credentials: true,
origins: 'http://example.com'
});
Now the cors
variable contains a function that should receive your request
and response
. So it's as easy as:
var http = require('http').createServer(function (req, res) {
if (cors(req, res)) return;
res.end('hello world');
}).listen(8080);
You might have noticed that we've added an if statement around our cors
function call. This is because the module will be answering the preflight
request for you. So when it returns the boolean true
you don't have to
respond the request any more. In addition to the answering the option request is
also answer the requests with a 403 Forbidden
when the validation of the
Access Control is failing.
In order to not waste to much bandwidth, the CORS headers will only be added if
the request contains an Origin
header, which should be sent by every request
that requires HTTP Access Control information.
The library has build-in support for express based middleware (req, res, next). In fact, it's build in to the returned function so all you need to do is:
var app = express();
app.use(require('access-control')({ /* options here */ }));
And you have CORS handling enabled on your express instance. It's that easy.
If you're using Phonegap, your XHR requests will be sent with Origin: null
as
Origin header. In order to resolve this you must add the domain you are
requesting to your origin white list:
http://docs.phonegap.com/en/1.9.0/guide_whitelist_index.md.html
This will ensure that the correct headers will be used for these cross domain/origin requests.
If you're interested in learning more about HTTP Access Control (CORS) here's a good list to get started with:
MIT
FAQs
Easily handle HTTP Access Control (CORS) in your applications
The npm package access-control receives a total of 8,567 weekly downloads. As such, access-control popularity was classified as popular.
We found that access-control demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Open source maintainers are urging GitHub to let them block Copilot from submitting AI-generated issues and pull requests to their repositories.
Research
Security News
Malicious Koishi plugin silently exfiltrates messages with hex strings to a hardcoded QQ account, exposing secrets in chatbots across platforms.
Research
Security News
Malicious PyPI checkers validate stolen emails against TikTok and Instagram APIs, enabling targeted account attacks and dark web credential sales.