From 533286a6fd0b298b37bf5e768f98ab8f9fb53237 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Bajto=C5=A1?= Date: Wed, 14 Sep 2016 11:40:38 +0200 Subject: [PATCH] Deprecate built-in CORS middleware Push the responsibility of enabling/configuring CORS back to the application developer. --- lib/jsonrpc-adapter.js | 9 +++++++++ lib/rest-adapter.js | 9 +++++++++ test/auth.test.js | 2 +- test/authorize-hook.test.js | 2 +- test/jsonrpc.test.js | 2 +- test/phase-handlers.test.js | 4 ++-- test/rest-adapter.test.js | 4 ++-- test/rest-coercion.test.js | 1 + test/rest.browser.test.js | 2 +- test/rest.test.js | 10 ++++++++-- test/streams.js | 4 ++-- test/type.test.js | 2 +- 12 files changed, 38 insertions(+), 13 deletions(-) diff --git a/lib/jsonrpc-adapter.js b/lib/jsonrpc-adapter.js index 8c59abe6..9f285b41 100644 --- a/lib/jsonrpc-adapter.js +++ b/lib/jsonrpc-adapter.js @@ -15,6 +15,7 @@ module.exports = JsonRpcAdapter; var EventEmitter = require('events').EventEmitter; var debug = require('debug')('strong-remoting:jsonrpc-adapter'); +var deprecated = require('depd')('strong-remoting'); var util = require('util'); var inherits = util.inherits; var jayson = require('jayson'); @@ -145,6 +146,14 @@ JsonRpcAdapter.prototype.createHandler = function() { var corsOptions = this.remotes.options.cors; if (corsOptions === undefined) corsOptions = {origin: true, credentials: true}; + if (corsOptions !== false) { + deprecated(g.f( + 'The built-in CORS middleware provided by JsonRpc adapter ' + + 'was deprecated. See %s for more details.', + 'https://docs.strongloop.com/display/public/LB/Security+considerations' + )); + } + // Optimize the cors handler var corsHandler = function(req, res, next) { var reqUrl = req.protocol + '://' + req.get('host'); diff --git a/lib/rest-adapter.js b/lib/rest-adapter.js index a097a744..c27c9371 100644 --- a/lib/rest-adapter.js +++ b/lib/rest-adapter.js @@ -19,6 +19,7 @@ RestAdapter.RestMethod = RestMethod; var deprecated = require('depd')('strong-remoting'); var EventEmitter = require('events').EventEmitter; var debug = require('debug')('strong-remoting:rest-adapter'); +var deprecated = require('depd')('strong-remoting'); var util = require('util'); var inherits = util.inherits; var assert = require('assert'); @@ -244,6 +245,14 @@ RestAdapter.prototype.createHandler = function() { var corsOptions = this.remotes.options.cors; if (corsOptions === undefined) corsOptions = {origin: true, credentials: true}; + if (corsOptions !== false) { + deprecated(g.f( + 'The built-in CORS middleware provided by REST adapter ' + + 'was deprecated. See %s for more details.', + 'https://docs.strongloop.com/display/public/LB/Security+considerations' + )); + } + // Optimize the cors handler var corsHandler = function(req, res, next) { var reqUrl = req.protocol + '://' + req.get('host'); diff --git a/test/auth.test.js b/test/auth.test.js index 0b765fb4..80a41bde 100644 --- a/test/auth.test.js +++ b/test/auth.test.js @@ -14,7 +14,7 @@ var User = require('./e2e/fixtures/user'); describe('support for HTTP Authentication', function() { var server; - var remotes = RemoteObjects.create(); + var remotes = RemoteObjects.create({cors: false}); remotes.exports.User = User; before(function setupServer(done) { diff --git a/test/authorize-hook.test.js b/test/authorize-hook.test.js index 870a9fd3..4256d1a9 100644 --- a/test/authorize-hook.test.js +++ b/test/authorize-hook.test.js @@ -16,7 +16,7 @@ describe('authorization hook', function() { before(function setupServer(done) { var app = express(); - remotes = RemoteObjects.create(); + remotes = RemoteObjects.create({cors: false}); remotes.exports.User = User; app.use(remotes.handler('rest')); server = app.listen(0, '127.0.0.1', done); diff --git a/test/jsonrpc.test.js b/test/jsonrpc.test.js index 9c1dc8eb..280fddde 100644 --- a/test/jsonrpc.test.js +++ b/test/jsonrpc.test.js @@ -18,7 +18,7 @@ describe('strong-remoting-jsonrpc', function() { // setup beforeEach(function() { if (server) server.close(); - objects = RemoteObjects.create({json: {limit: '1kb'}}); + objects = RemoteObjects.create({json: {limit: '1kb'}, cors: false}); remotes = objects.exports; app = express(); }); diff --git a/test/phase-handlers.test.js b/test/phase-handlers.test.js index 88bd81e9..8d2606f9 100644 --- a/test/phase-handlers.test.js +++ b/test/phase-handlers.test.js @@ -13,7 +13,7 @@ describe('phase handlers', function() { beforeEach(function setupServer(done) { var app = express(); - remotes = RemoteObjects.create(); + remotes = RemoteObjects.create({cors: false}); remotes.exports.User = User; app.use(function(req, res, next) { // always build a new handler to pick new methods added by tests @@ -23,7 +23,7 @@ describe('phase handlers', function() { }); beforeEach(function setupClient() { - clientRemotes = RemoteObjects.create(); + clientRemotes = RemoteObjects.create({cors: false}); clientRemotes.exports.User = User; var url = 'http://127.0.0.1:' + server.address().port; clientRemotes.connect(url, 'rest'); diff --git a/test/rest-adapter.test.js b/test/rest-adapter.test.js index 8ed49fe0..25391739 100644 --- a/test/rest-adapter.test.js +++ b/test/rest-adapter.test.js @@ -19,7 +19,7 @@ describe('RestAdapter', function() { var remotes; beforeEach(function() { - remotes = RemoteObjects.create(); + remotes = RemoteObjects.create({cors: false}); }); describe('getClasses()', function() { @@ -383,7 +383,7 @@ describe('RestAdapter', function() { var remotes, req, res; beforeEach(function() { - remotes = RemoteObjects.create(); + remotes = RemoteObjects.create({cors: false}); req = false; res = false; diff --git a/test/rest-coercion.test.js b/test/rest-coercion.test.js index 7fadd8db..7eef2aff 100644 --- a/test/rest-coercion.test.js +++ b/test/rest-coercion.test.js @@ -58,6 +58,7 @@ describe('Coercion in RestAdapter', function() { function setupRemoteObjects() { ctx.remoteObjects = RemoteObjects.create({ errorHandler: { debug: true, log: false }, + cors: false, }); } diff --git a/test/rest.browser.test.js b/test/rest.browser.test.js index 260080c6..7b4e68ba 100644 --- a/test/rest.browser.test.js +++ b/test/rest.browser.test.js @@ -30,7 +30,7 @@ describe('strong-remoting-rest', function() { // setup beforeEach(function() { - objects = RemoteObjects.create(); + objects = RemoteObjects.create({cors: false}); remotes = objects.exports; // connect to the app diff --git a/test/rest.test.js b/test/rest.test.js index 90e54676..a15e1ed7 100644 --- a/test/rest.test.js +++ b/test/rest.test.js @@ -54,8 +54,11 @@ describe('strong-remoting-rest', function() { if (process.env.NODE_ENV === 'production') { process.env.NODE_ENV = 'test'; } - objects = RemoteObjects.create({json: {limit: '1kb'}, - errorHandler: {disableStackTrace: false}}); + objects = RemoteObjects.create({ + json: {limit: '1kb'}, + errorHandler: {disableStackTrace: false}, + cors: false, + }); remotes = objects.exports; // connect to the app @@ -325,6 +328,9 @@ describe('strong-remoting-rest', function() { describe('cors', function() { var method; beforeEach(function() { + delete objects.options.cors; // use the default setting + process.once('deprecation', function() { /* ignore */ }); + method = givenSharedStaticMethod( function greet(person, cb) { if (person === 'error') { diff --git a/test/streams.js b/test/streams.js index e2f7e534..75349237 100644 --- a/test/streams.js +++ b/test/streams.js @@ -19,7 +19,7 @@ describe('strong-remoting', function() { var objects; beforeEach(function() { - objects = RemoteObjects.create(); + objects = RemoteObjects.create({cors: false}); remotes = objects.exports; app = express(); app.disable('x-powered-by'); @@ -69,7 +69,7 @@ describe('strong-remoting', function() { describe('a function returning a ReadableStream', function() { var Readable = require('stream').Readable; - var remotes = RemoteObjects.create(); + var remotes = RemoteObjects.create({cors: false}); var streamClass; var server; var app; diff --git a/test/type.test.js b/test/type.test.js index 0e7d8573..9bfc2c5c 100644 --- a/test/type.test.js +++ b/test/type.test.js @@ -10,7 +10,7 @@ var RemoteObjects = require('../'); describe('types', function() { var remotes; beforeEach(function() { - remotes = RemoteObjects.create(); + remotes = RemoteObjects.create({cors: false}); }); describe('remotes.defineType(name, fn)', function() { it('should define a new type converter', function() {