使用jub0bs/cors实现CORS配置错误的程序化处理

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

package main

import (
    "fmt"
    "io"
    "net/http"
    "os"

    "github.com/jub0bs/cors"
)

func main() {
    _, err := cors.NewMiddleware(cors.Config{
        Origins:         []string{"*"},
        Credentialed:    true,
        Methods:         []string{"POS T"},
        ResponseHeaders: []string{"Set-Cookie"},
    })
    if err != nil {
        fmt.Fprintln(os.Stderr, err)
        os.Exit(1)
    }
}

1
2
3

cors: invalid method "POS T"
cors: forbidden response-header name "Set-Cookie"
cors: for security reasons, you cannot both allow all origins and enable credentialed access

1
2
3
4
5

[
  "\"POS T\" is not a valid HTTP method. Did you mean \"POST\"?",
  "\"Set-Cookie\" is not a response header that can be exposed.",
  "You cannot allow access from all origins with cookies."
]

1

func All(err error) iter.Seq[error]

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112

package main

import (
    "encoding/json"
    "fmt"
    "io"
    "log"
    "mime"
    "net/http"

    "github.com/jub0bs/cors"
    "github.com/jub0bs/cors/cfgerrors"
)

func main() {
    app := TenantApp{id: "jub0bs"}

    mux := http.NewServeMux()
    mux.HandleFunc("POST /configure-cors", app.handleReconfigureCORS)

    api := http.NewServeMux()
    api.HandleFunc("GET /hello", handleHello)
    mux.Handle("/", app.corsMiddleware.Wrap(api))

    if err := http.ListenAndServe(":8080", mux); err != http.ErrServerClosed {
        log.Fatal(err)
    }
}

type TenantApp struct {
    id             string
    corsMiddleware cors.Middleware
}

func (app *TenantApp) handleReconfigureCORS(w http.ResponseWriter, r *http.Request) {
    mediatype, _, err := mime.ParseMediaType(r.Header.Get("Content-Type"))
    if err != nil || mediatype != "application/json" {
        w.WriteHeader(http.StatusBadRequest)
        return
    }
    var reqData struct {
        Origins     []string `json:"origins"`
        Credentials bool     `json:"credentials"`
    }
    if err := json.NewDecoder(r.Body).Decode(&reqData); err != nil {
        w.WriteHeader(http.StatusBadRequest)
        return
    }
    cfg := cors.Config{
        Origins:      reqData.Origins,
        Credentialed: reqData.Credentials,
    }

    if err := app.corsMiddleware.Reconfigure(&cfg); err != nil {
        w.Header().Set("Content-Type", "application/json")
        w.WriteHeader(http.StatusBadRequest)
        var resData = struct {
            Errors []string `json:"errors"`
        }{
            Errors: adaptCORSConfigErrorMessagesForClient(err),
        }
        if err := json.NewEncoder(w).Encode(resData); err != nil {
            w.WriteHeader(http.StatusInternalServerError)
            return
        }
    }
}

func adaptCORSConfigErrorMessagesForClient(err error) []string {
    var msgs []string
    for err := range cfgerrors.All(err) {
        switch err := err.(type) {
        case *cfgerrors.UnacceptableOriginPatternError:
            var msg string
            switch err.Reason {
            case "missing":
                msg = "You must allow at least one Web origin."
            case "invalid":
                msg = fmt.Sprintf("%q is not a valid Web origin.", err.Value)
            case "prohibited":
                msg = fmt.Sprintf("For security reasons, you cannot allow Web origin %q.", err.Value)
            default:
                panic("unknown reason")
            }
            msgs = append(msgs, msg)
        case *cfgerrors.IncompatibleOriginPatternError:
            var msg string
            switch err.Reason {
            case "credentialed":
                if err.Value == "*" {
                    msg = "For security reasons, you cannot both allow credentialed access and allow all Web origins."
                } else {
                    const tmpl = "For security reasons, you cannot both allow credentialed access allow insecure origins like %q."
                    msg = fmt.Sprintf(tmpl, err.Value)
                }
            case "psl":
                const tmpl = "For security reasons, you cannot specify %q as an origin pattern, because it covers all subdomains of a registrable domain."
                msg = fmt.Sprintf(tmpl, err.Value)
            default:
                panic("unknown reason")
            }
            msgs = append(msgs, msg)
        default:

        }
    }
    return msgs
}

func handleHello(w http.ResponseWriter, _ *http.Request) {
    io.WriteString(w, "Hello, World!")
}

1
2
3

curl -v localhost:8080/configure-cors \
    -H "Content-Type: application/json" \
    --data '{"origins":["*"],"credentials":true}'

1
2
3
4
5
6

HTTP/1.1 400 Bad Request
Content-Type: application/json
Date: Wed, 15 Jan 2025 17:50:02 GMT
Content-Length: 106

{"errors":["For security reasons, you cannot both allow credentialed access and allow all Web origins."]}