cors - npm Package Compare versions

Comparing version 2.7.1 to 2.7.2

lib/index.js

@@ -184,3 +184,3 @@ (function () {
     // if no options were passed in, use the defaults
-    if (!o) {
+    if (!o || o === true) {
       o = {};
@@ -208,3 +208,3 @@ }
 
-    return function (req, res, next) {
+    return function corsMiddleware(req, res, next) {
       optionsCallback(req, function (err, options) {
@@ -211,0 +211,0 @@ if (err) {

package.json

 {
   "name": "cors",
-  "version": "2.7.1",
+  "version": "2.7.2",
   "author": "Troy Goode <[e-mail]> (https://github.com/troygoode/)",
@@ -5,0 +5,0 @@ "description": "middleware for dynamically or statically enabling CORS in express/connect applications",

README.md

@@ -9,3 +9,3 @@ # `cors`
 
-[![build status](https://secure.travis-ci.org/expressjs/cors.png)](http://travis-ci.org/expressjs/cors)
+[![build status](https://secure.travis-ci.org/expressjs/cors.svg?branch=master)](http://travis-ci.org/expressjs/cors)
 * [Installation](#installation)
@@ -96,3 +96,3 @@ * [Usage](#usage)
     var originIsWhitelisted = whitelist.indexOf(origin) !== -1;
-    callback(null, originIsWhitelisted);
+    callback(originIsWhitelisted ? null : 'Bad Request', originIsWhitelisted);
   }
@@ -169,3 +169,8 @@ };
 
-* `origin`: Configures the **Access-Control-Allow-Origin** CORS header. Expects a string (ex: "http://example.com"). Set to `true` to reflect the [request origin](http://tools.ietf.org/html/draft-abarth-origin-09), as defined by `req.header('Origin')`. Set to `false` to disable CORS. Can also be set to a function, which takes the request origin as the first parameter and a callback (which expects the signature `err [object], allow [bool]`) as the second. Finally, it can also be a regular expression (`/example\.com$/`) or an array of regular expressions and/or strings to match against.
+* `origin`: Configures the **Access-Control-Allow-Origin** CORS header. Possible values:
+ - `Boolean` - set `origin` to `true` to reflect the [request origin](http://tools.ietf.org/html/draft-abarth-origin-09), as defined by `req.header('Origin')`, or set it to `false` to disable CORS.
+ - `String` - set `origin` to a specific origin. For example if you set it to `"http://example.com"` only requests from "http://example.com" will be allowed.
+ - `RegExp` - set `origin` to a regular expression pattern which will be used to test the request origin. If it's a match, the request origin will be reflected. For example the pattern `/example\.com$/` will reflect any request that is coming from an origin ending with "example.com".
+ - `Array` - set `origin` to an array of valid origins. Each origin can be a `String` or a `RegExp`. For example `["http://example1.com", /\.example2\.com$/]` will accept any request from "http://example1.com" or from a subdomain of "example2.com".
+ - `Function` - set `origin` to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (which expects the signature `err [object], allow [bool]`) as the second.
 * `methods`: Configures the **Access-Control-Allow-Methods** CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: `['GET', 'PUT', 'POST']`).
@@ -175,7 +180,17 @@ * `allowedHeaders`: Configures the **Access-Control-Allow-Headers** CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: `['Content-Type', 'Authorization']`). If not specified, defaults to reflecting the headers specified in the request's **Access-Control-Request-Headers** header.
 * `credentials`: Configures the **Access-Control-Allow-Credentials** CORS header. Set to `true` to pass the header, otherwise it is omitted.
-* `maxAge`: Configures the **Access-Control-Allow-Max-Age** CORS header. Set to an integer to pass the header, otherwise it is omitted.
+* `maxAge`: Configures the **Access-Control-Max-Age** CORS header. Set to an integer to pass the header, otherwise it is omitted.
 * `preflightContinue`: Pass the CORS preflight response to the next handler.
 
-For details on the effect of each CORS header, [read this article on HTML5 Rocks](http://www.html5rocks.com/en/tutorials/cors/).
+The default configuration is the equivalent of:
 
+```json
+{
+  "origin": "*",
+  "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
+  "preflightContinue": false
+}
+```
+
+For details on the effect of each CORS header, read [this](http://www.html5rocks.com/en/tutorials/cors/) article on HTML5 Rocks.
+
 ## Demo
@@ -182,0 +197,0 @@

test/cors.js

@@ -180,3 +180,3 @@ (function () {
           res.getHeader('Access-Control-Allow-Credentials').should.equal('true');
-          res.getHeader('Access-Control-Allow-Max-Age').should.equal('123');
+          res.getHeader('Access-Control-Max-Age').should.equal('123');
           done();
@@ -245,3 +245,3 @@ };
           should.not.exist(res.getHeader('Access-Control-Allow-Credentials'));
-          should.not.exist(res.getHeader('Access-Control-Allow-Max-Age'));
+          should.not.exist(res.getHeader('Access-Control-Max-Age'));
           done();
@@ -378,3 +378,3 @@ };
           should.not.exist(res.getHeader('Access-Control-Allow-Credentials'));
-          should.not.exist(res.getHeader('Access-Control-Allow-Max-Age'));
+          should.not.exist(res.getHeader('Access-Control-Max-Age'));
           done();
@@ -413,3 +413,3 @@ };
           should.not.exist(res.getHeader('Access-Control-Allow-Credentials'));
-          should.not.exist(res.getHeader('Access-Control-Allow-Max-Age'));
+          should.not.exist(res.getHeader('Access-Control-Max-Age'));
           done();
@@ -606,3 +606,3 @@ };
           // assert
-          should.not.exist(res.getHeader('Access-Control-Allow-Max-Age'));
+          should.not.exist(res.getHeader('Access-Control-Max-Age'));
           done();
@@ -609,0 +609,0 @@ };

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

49628

increased by1.67%

Number of lines in readme file

208

increased by7.77%

No dependency changes