File Coverage

blib/lib/Mojolicious/Plugin/StrictCORS.pm

Criterion	Covered	Total	%
statement	6	124	4.8
branch	0	60	0.0
condition	0	26	0.0
subroutine	2	10	20.0
pod	1	1	100.0
total	9	221	4.0

package Mojolicious::Plugin::StrictCORS;
use Mojo::Base 'Mojolicious::Plugin';

our $VERSION = "0.02";
$VERSION = eval $VERSION;

use constant DEFAULT_MAX_AGE => 3600;

sub register {
  my ($self, $app, $conf) = @_;

  $conf->{max_age}  //= DEFAULT_MAX_AGE;
  $conf->{expose}   //= [];

  # Recursive get route params
  my $route_params = sub {
    my ($c) = @_;

    my $route = $c->match->endpoint;

    my %params;
    my @fields = qw/origin credentials expose methods headers/;

    while ($route) {
      for my $name (@fields) {
        next if exists $params{$name};
        next unless exists $route->to->{"cors_${name}"};

        $params{$name} = $route->to->{"cors_${name}"};
      }

      $route = $route->parent;
    }

    return \%params;
  };

  my $check_preflight = sub {
    my ($c) = @_;

    my $h = $c->req->headers;

    return 1 if $h->header('Origin') =~ qr/\S/ms
      and $h->header('Access-Control-Request-Method') =~ qr/\S/ms;

    return; # Fail
  };

  # Check Origin header
  my $check_origin = sub {
    my ($c, @allow) = @_;

    my $h = $c->req->headers;

    my $origin = $h->origin;
    return unless defined $origin;

    return $origin if grep { not ref $_ and $_ eq '*' } @allow;

    return $origin if grep {
      if    (not ref $_)          { lc $origin eq lc $_ }
      elsif (ref $_ eq 'Regexp')  { $origin =~ $_ }
      else  { die "Router 'cors_origin' param must be scalar or Regexp\n" }
    } @allow;

    $app->log->debug("Reject CORS Origin '$origin'");

    return; # Fail
  };

  # Check request method
  my $check_methods = sub {
    my ($c, @allow) = @_;

    my $h = $c->req->headers;

    my $method = $h->header('Access-Control-Request-Method');
    return unless defined $method;

    my $allow = join ", ", @allow;

    return $allow if grep {
      if    (not ref $_)  { uc $method eq uc $_ }
      else  { die "Router 'cors_methods' param must be scalar\n" }
    } @allow;

    $app->log->debug("Reject CORS Method '$method'");

    return; # Fail
  };

  # Check request headers
  my $check_headers = sub {
    my ($c, @allow) = @_;

    my $h = $c->req->headers;

    my @safe_headers = qw/
      Cache-Control
      Content-Language
      Content-Type
      Expires
      Last-Modified
      Pragma
    /;

    my %safe_headers = map { lc $_ => 1 } @safe_headers;
    my $allow = join ", ", @allow;

    my $headers = $h->header('Access-Control-Request-Headers');
    my @headers = map { lc } grep { $_ } split /,\s*/ms, $headers || '';

    return $allow unless @headers;

    return $allow unless grep {
      if    (not ref $_)  { not $safe_headers{ lc $_ } }
      else  { die "Router 'cors_headers' param must be scalar\n" }
    } @allow;

    $app->log->debug("Reject CORS Headers '$headers'");

    return; # Fail
  };

  $app->hook(around_action => sub {
    my ($next, $c, $action, $last) = @_;

    # Only endpoints intrested
    return $next->() unless $last;

    # Do not process preflight requests
    return $next->() if $c->req->method eq 'OPTIONS';

    my $params = $route_params->($c);

    # Do not process routes without cors_origin configured
    my @params_origin = @{$params->{origin} //= []};
    return $next->() unless @params_origin;

    my $h = $c->res->headers;
    $h->append('Vary' => 'Origin');

    my $origin = $check_origin->($c, @params_origin);
    return $next->() unless defined $origin;

    $h->header('Access-Control-Allow-Origin' => $origin);

    $h->header('Access-Control-Allow-Credentials' => 'true')
      if $params->{credentials} //= 0;

    my @params_expose = (@{$conf->{expose}}, @{$params->{expose} //= []});
    if (@params_expose) {
      my $params_expose = join ", ", @params_expose;
      $h->header('Access-Control-Expose-Headers' => $params_expose);
    }

    $app->log->debug("Allow CORS Origin '$origin'");

    return $next->();
  });

  # CORS Preflight
  $app->routes->add_shortcut(cors => sub {
    my ($r, @args) = @_;

    $r->options(@args)->to(
      cb => sub {
        my ($c) = @_;

        return $c->render(status => 204, data => '')
          unless $check_preflight->($c);

        my $params = $route_params->($c);

        my @params_origin = @{$params->{origin} //= []};
        return $c->render(status => 204, data => '')
          unless @params_origin;

        my $h = $c->res->headers;
        $h->append('Vary' => 'Origin');

        my $origin = $check_origin->($c, @params_origin);
        return $c->render(status => 204, data => '')
          unless defined $origin;

        my @params_methods = @{$params->{methods} //= []};
        push @params_methods, 'HEAD'
          if grep { uc $_ eq 'GET' } @params_methods
            and not grep { uc $_ eq 'HEAD' } @params_methods;
        return $c->render(status => 204, data => '')
          unless @params_methods;

        my $methods = $check_methods->($c, @params_methods);
        return $c->render(status => 204, data => '')
          unless defined $methods;

        my @params_headers = @{$params->{headers} //= []};

        my $headers = $check_headers->($c, @params_headers);
        return $c->render(status => 204, data => '')
          unless defined $headers;

        $h->header('Access-Control-Allow-Origin'  => $origin);
        $h->header('Access-Control-Allow-Methods' => $methods);

        $h->header('Access-Control-Allow-Headers' => $headers)
          if $headers;

        $h->header('Access-Control-Allow-Credentials' => 'true')
          if $params->{credentials} //= 0;

        $h->header('Access-Control-Max-Age' => $conf->{max_age});

        $app->log->debug("Accept CORS '$origin' => '$methods'");
        return $c->render(status => 204, data => '');
      }
    );
  });
}

1;

__END__