cordova-spotify-oauth - npm Package Compare versions

Comparing version 0.1.10 to 0.1.11

install-ios.sh

 #!/usr/bin/env bash
 
 INSTALL_PATH="plugins/cordova-spotify-oauth/src/ios/spotify-sdk"
-DOWNLOAD_PATH="https://github.com/spotify/ios-sdk/archive/beta-25.tar.gz"
+DOWNLOAD_PATH="https://github.com/spotify/ios-streaming-sdk/archive/beta-25.tar.gz"
 
@@ -6,0 +6,0 @@ if [ ! -d $INSTALL_PATH ]; then

oauth-token-api/serverless.yml

@@ -7,5 +7,4 @@ ---
   name: aws
-  runtime: nodejs4.3
+  runtime: nodejs8.10
   region: eu-central-1
-  profile: festify
   memorySize: 128
@@ -24,2 +23,3 @@
           method: post
+          cors: true
   refreshToken:
@@ -31,1 +31,2 @@ handler: spotifyTokenService.refreshToken
           method: post
+          cors: true

oauth-token-api/spotifyTokenService.js

@@ -17,2 +17,15 @@ 'use strict';
 
+
+// add CORS headers to response
+// Reference: https://serverless.com/blog/cors-api-gateway-survival-guide/#cors-response-headers
+function cors(response) {
+  if (response) {
+    const headers = response.headers || {};
+    headers["Access-Control-Allow-Origin"] = "*"; // Required for CORS support to work
+    headers["Access-Control-Allow-Credentials"] = true;  // Required for cookies, authorization headers with HTTPS
+    response.headers = headers;
+  }
+  return response;
+}
+
 const spotifyRequest = params => {
@@ -51,3 +64,3 @@ return new Promise((resolve, reject) => {
     if (!params.code) {
-        callback(null, {
+        callback(null, cors({
             statusCode: 400,
@@ -57,3 +70,3 @@ body: JSON.stringify({
             })
-        });
+        }));
         return;
@@ -81,3 +94,3 @@ }
         .then(response => {
-           callback(null, response);
+           callback(null, cors(response));
         });
@@ -90,3 +103,3 @@ };
     if (!params.refresh_token) {
-        callback(null, {
+        callback(null, cors({
             statusCode: 400,
@@ -96,3 +109,3 @@ body: JSON.stringify({
             })
-        });
+        }));
         return;
@@ -118,4 +131,4 @@ }
         .then(response => {
-            callback(null, response);
+            callback(null, cors(response));
         });
 };

package.json

 {
   "name": "cordova-spotify-oauth",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Cordova plugin for authenticating with Spotify",
@@ -5,0 +5,0 @@ "main": "www/build/spotify-oauth.min.js",

plugin.xml

 <?xml version='1.0' encoding='utf-8'?>
-<plugin id="cordova-spotify-oauth" version="0.1.10" xmlns="http://apache.org/cordova/ns/plugins/1.0" xmlns:android="http://schemas.android.com/apk/res/android">
+<plugin id="cordova-spotify-oauth" version="0.1.11" xmlns="http://apache.org/cordova/ns/plugins/1.0" xmlns:android="http://schemas.android.com/apk/res/android">
     <name>cordova-spotify-oauth</name>
@@ -4,0 +4,0 @@

README.md

@@ -66,3 +66,3 @@ # Cordova Spotify OAuth Plugin
 
-The authorization code flow requires server code for security. These come in the form of two HTTP endpoints, one for the auth code exchange, and the other one for access token refresh. The SDK will POST `application/x-www-form-urlencoded` data and expects JSON back.
+The authorization code flow requires server code for security. These come in the form of two HTTP endpoints, one for the auth code exchange, and the other one for access token refresh. The SDK will POST `application/x-www-form-urlencoded` data and expects JSON back. Ensure you have proper CORS config set up.
 
@@ -69,0 +69,0 @@ To easily implement them, we built a [Serverless][serverless] service for [AWS Lambda][aws-lambda] over in the [`oauth-token-api`][token-api-example] folder. Make sure you [install the Serverless Framework properly][serverless-installation]!

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances in 1 package

Improved metrics

Total package byte prevSize

318202

0.18%

Lines of code

703

1.59%

No dependency changes