webrtc-signal-http - npm Package Compare versions

Comparing version 1.2.0 to 1.3.0

index.js

@@ -8,3 +8,4 @@ #!/usr/bin/env node
 app.use(signalRouterCreator({
-    enableLogging: process.env.WEBRTC_SIGNAL_LOGGING || true
+    enableLogging: process.env.WEBRTC_SIGNAL_LOGGING || true,
+    enableCors: process.env.WEBRTC_CORS || true
 })).listen(process.env.PORT || 3000)

lib/index.js

 const express = require('express')
+const cors = require('cors')
 const bodyParser = require('body-parser')
@@ -6,2 +7,3 @@ const expressBunyan = require('express-bunyan-logger')
 
+
 module.exports = (opts) => {
@@ -22,2 +24,7 @@ const router = express.Router()
 
+    if (opts.enableCors) {
+        router.use(cors())
+        router.options("*", cors())
+    }
+
     // abstracted peer message sender logic
@@ -24,0 +31,0 @@ // this will direct send if possible, otherwise

package.json

 {
   "name": "webrtc-signal-http",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "opinionated webrtc signal provider using http as a protocol",
@@ -25,2 +25,3 @@ "main": "lib/index.js",
     "body-parser": "^1.18.2",
+    "cors": "^2.8.4",
     "express": "^4.16.2",
@@ -27,0 +28,0 @@ "express-bunyan-logger": "^1.3.2"

README.md

@@ -231,2 +231,6 @@ # webrtc-signal-http
 
+#### enableCors
+
+[Bool] - enables Cross Origin Resource Sharing (default `true`)
+
 #### peerList
@@ -233,0 +237,0 @@

test/basic.js

@@ -8,5 +8,6 @@ const assert = require('assert')
 
-const appCreator = (enableLogging) => {
+const appCreator = (enableLogging, enableCors) => {
     const router = signalRouter({
-        enableLogging: enableLogging
+        enableLogging: enableLogging,
+        enableCors: enableCors
     })
@@ -38,3 +39,3 @@ const app = express()
 
-            request(appCreator(false))
+            request(appCreator(false, false))
                 .get(`/sign_in?peer_name=${expectedPeerName}`)
@@ -45,2 +46,26 @@ .expect('Content-Type', /text\/plain/)
 
+        it('should support CORS requests if enabled', (done) => {
+            const expectedPeerName = 'myName'
+
+            request(appCreator(false, true))
+            .get("/")
+            .expect("access-control-allow-origin", "*", done)
+        })
+
+        it('should prevent CORS requests if disabled', (done) => {
+            const expectedPeerName = 'myName'
+
+            request(appCreator(false, false))
+            .get("/")
+            .end(function (error, response) {
+                if (error) {
+                    return done(error)
+                }
+
+                var corsDisabled = response.header["access-control-allow-origin"] == undefined;
+                assert.equal(corsDisabled, true)
+                done()
+            })
+        })
+
         it('should support multiple sign_in', (done) => {
@@ -50,3 +75,3 @@ const expectedPeerName = 'myName'
 
-            const test = request(appCreator(false))
+            const test = request(appCreator(false, false))
 
@@ -70,3 +95,3 @@ test
         it('should support /message posting (buffered)', (done) => {
-            const app = appCreator(false)
+            const app = appCreator(false, false)
 
@@ -91,3 +116,3 @@ const senderPeerId = app.peerList.addPeer('sendPeer', {})
         it('should support /message posting (un-buffered)', (done) => {
-            const app = appCreator(false)
+            const app = appCreator(false, false)
 
@@ -119,3 +144,3 @@ // simulate adding two peers
         it('should support /sign_out', (done) => {
-            const app = appCreator(false)
+            const app = appCreator(false, false)
 
@@ -138,3 +163,3 @@ // simulate adding two peers
         it('should support sign_in notifications', (done) => {
-            const app = appCreator(false)
+            const app = appCreator(false, false)
 
@@ -163,3 +188,3 @@ // simulate adding two peers
         it('should support sign_out notifications', (done) => {
-            const app = appCreator(false)
+            const app = appCreator(false, false)
 
@@ -187,2 +212,4 @@ // simulate adding two peers
         })
+
+        
     })
@@ -189,0 +216,0 @@

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

2113536

increased by0.05%

Lines of code

457

increased by6.03%

Number of lines in readme file

241

increased by1.69%

Worsened metrics

Dependency count

4

increased by33.33%

Number of low supply chain risk alerts

4

increased by33.33%

Dependency changes

• + Addedcors@^2.8.4

• + Addedcors@2.8.5(transitive)

• + Addedobject-assign@4.1.1(transitive)