mockttp - npm Package Compare versions

Comparing version 0.14.3 to 0.14.4

dist/client/mockttp-client.js

@@ -301,3 +301,3 @@ "use strict";
                         body,
-                        timingEvents
+                        ${this.typeHasField('Response', 'timingEvents') ? 'timingEvents' : ''}
                     }
@@ -304,0 +304,0 @@ }`

dist/standalone/mockttp-standalone.d.ts

@@ -5,2 +5,3 @@ /**
 /// <reference path="../../custom-typings/asynciterator.d.ts" />
+import * as cors from 'cors';
 import { MockttpOptions } from '../mockttp';
@@ -10,2 +11,3 @@ export interface StandaloneServerOptions {
     serverDefaults?: MockttpOptions;
+    corsOptions?: cors.CorsOptions;
 }
@@ -12,0 +14,0 @@ export declare class MockttpStandalone {

dist/standalone/mockttp-standalone.js

@@ -43,3 +43,17 @@ "use strict";
             console.log('Standalone server started in debug mode');
-        this.app.use(cors());
+        this.app.use(cors(options.corsOptions));
+        this.app.use((req, res, next) => {
+            const origin = req.headers['origin'];
+            // This will have been set (or intentionally not set), by the CORS middleware
+            const allowedOrigin = res.getHeader('Access-Control-Allow-Origin');
+            // If origin is set (null or an origin) but was not accepted by the CORS options
+            // Note that if no options.cors is provided, allowedOrigin is always *.
+            if (origin !== undefined && allowedOrigin !== '*' && allowedOrigin !== origin) {
+                // Don't process the request: error out & skip the lot (to avoid CSRF)
+                res.status(403).send('CORS request sent by unacceptable origin');
+            }
+            else {
+                next();
+            }
+        });
         this.app.use(bodyParser.json());
@@ -75,3 +89,4 @@ this.app.post('/start', (req, res) => __awaiter(this, void 0, void 0, function* () {
                 res.status(404).send('Unknown mock server');
-                throw new Error(`Request for unknown mock server port: ${req.params.port}`);
+                console.error(`Request for unknown mock server port: ${req.params.port}`);
+                return;
             }
@@ -78,0 +93,0 @@ this.routers[req.params.port](req, res, next);

package.json

 {
   "name": "mockttp",
-  "version": "0.14.3",
+  "version": "0.14.4",
   "description": "Mock HTTP server for testing HTTP clients and stubbing webservices",
@@ -59,3 +59,2 @@ "main": "dist/main.js",
     "@types/common-tags": "^1.4.0",
-    "@types/cors": "^2.8.1",
     "@types/graphql": "^14.0.2",
@@ -110,2 +109,3 @@ "@types/lodash": "^4.14.37",
   "dependencies": {
+    "@types/cors": "^2.8.1",
     "@types/express": "^4.0.33",
@@ -112,0 +112,0 @@ "@types/node": "^10.12.9",

src/client/mockttp-client.ts

@@ -315,3 +315,3 @@ /**
                         body,
-                        timingEvents
+                        ${this.typeHasField('Response', 'timingEvents') ? 'timingEvents' : ''}
                     }
@@ -318,0 +318,0 @@ }`

src/standalone/mockttp-standalone.ts

@@ -29,3 +29,3 @@ /**
 import { MockttpOptions } from '../mockttp';
-import { Duplex, PassThrough } from 'stream';
+import { Duplex } from 'stream';
 
@@ -35,2 +35,3 @@ export interface StandaloneServerOptions {
     serverDefaults?: MockttpOptions;
+    corsOptions?: cors.CorsOptions;
 }
@@ -49,3 +50,17 @@
 
-        this.app.use(cors());
+        this.app.use(cors(options.corsOptions));
+        this.app.use((req, res, next) => {
+            const origin = req.headers['origin'];
+            // This will have been set (or intentionally not set), by the CORS middleware
+            const allowedOrigin = res.getHeader('Access-Control-Allow-Origin');
+
+            // If origin is set (null or an origin) but was not accepted by the CORS options
+            // Note that if no options.cors is provided, allowedOrigin is always *.
+            if (origin !== undefined && allowedOrigin !== '*' && allowedOrigin !== origin) {
+                // Don't process the request: error out & skip the lot (to avoid CSRF)
+                res.status(403).send('CORS request sent by unacceptable origin');
+            } else {
+                next();
+            }
+        });
         this.app.use(bodyParser.json());
@@ -90,3 +105,4 @@
                 res.status(404).send('Unknown mock server');
-                throw new Error(`Request for unknown mock server port: ${req.params.port}`);
+                console.error(`Request for unknown mock server port: ${req.params.port}`);
+                return;
             }
@@ -93,0 +109,0 @@

No alert changes

Improved metrics

Total package byte prevSize

3357152

increased by0.11%

Dev dependency count

49

decreased by-2%

Lines of code

9116

increased by0.35%

Worsened metrics

Dependency count

27

increased by3.85%

Dependency changes

• + Added@types/cors@^2.8.1

• + Added@types/cors@2.8.17(transitive)