File Coverage

blib/lib/Mojolicious/Plugin/StrictCORS.pm

Criterion	Covered	Total	%
statement	6	125	4.8
branch	0	60	0.0
condition	0	25	0.0
subroutine	2	10	20.0
pod	1	1	100.0
total	9	221	4.0

package Mojolicious::Plugin::StrictCORS;
use Mojo::Base 'Mojolicious::Plugin';

our $VERSION = "0.01_002";
$VERSION = eval $VERSION;

use constant DEFAULT_MAX_AGE => 3600;

sub register {
  my ($self, $app, $conf) = @_;

  $conf->{max_age}  //= DEFAULT_MAX_AGE;
  $conf->{expose}   //= [];

  # Get route options
  my $route_opts = sub {
    my ($route) = @_;

    my %opts;

    my @fields = qw/origin credentials expose methods headers/;

    while ($route) {
      for my $name (@fields) {
        next if exists $opts{$name};
        next unless exists $route->to->{"cors_${name}"};

        $opts{$name} = $route->to->{"cors_${name}"}
      }

      $route = $route->parent;
    }

    return %opts;
  };

  # Check Origin header
  my $check_origin = sub {
    my ($c, @allow) = @_;

    my $origin = $c->req->headers->origin;
    return unless defined $origin;

    return $origin if grep { not ref $_ and $_ eq '*' } @allow;

    return $origin if grep {
      if    (not ref $_)          { lc $origin eq lc $_ }
      elsif (ref $_ eq 'Regexp')  { $origin =~ $_ }
      else  { die "Wrong router config 'cors_origin'" }
    } @allow;

    $app->log->debug("Reject CORS Origin '$origin'");

    return; # Fail
  };

  # Check request method
  my $check_methods = sub {
    my ($c, @allow) = @_;

    my $method = $c->req->headers->header('Access-Control-Request-Method');
    return unless defined $method;

    my $allow = join ", ", @allow;

    return $allow if grep {
      if    (not ref $_)  { uc $method eq uc $_ }
      else  { die "Wrong router config 'cors_methods'" }
    } @allow;

    $app->log->debug("Reject CORS Method '$method'");

    return; # Fail
  };

  # Check request headers
  my $check_headers = sub {
    my ($c, @allow) = @_;

    my @safe_headers = qw/
      Cache-Control
      Content-Language
      Content-Type
      Expires
      Last-Modified
      Pragma
    /;

    my %safe_headers = map { lc $_ => 1 } @safe_headers;
    my $allow = join ", ", @allow;

    my $headers = $c->req->headers->header('Access-Control-Request-Headers');
    my @headers = map { lc } grep { $_ } split /,\s*/ms, $headers || '';

    return $allow unless @headers;

    return $allow unless grep {
      if    (not ref $_)  { not $safe_headers{ lc $_ } }
      else  { die "Wrong router config 'cors_headers'" }
    } @allow;

    $app->log->debug("Reject CORS Headers '$headers'");

    return; # Fail
  };

  $app->hook(around_action => sub {
    my ($next, $c, $action, $last) = @_;

    # Only endpoints intrested
    return $next->() unless $last;

    # Do not process preflight requests
    return $next->() if $c->req->method eq 'OPTIONS';

    my %opts = $route_opts->($c->match->endpoint);

    my @opts_origin = @{$opts{origin} //= []};
    return $next->() unless @opts_origin;

    my $h = $c->res->headers;
    $h->append('Vary' => 'Origin');

    my $origin = $check_origin->($c, @opts_origin);
    return $next->() unless defined $origin;

    $h->header('Access-Control-Allow-Origin' => $origin);

    $h->header('Access-Control-Allow-Credentials' => 'true')
      if $opts{credentials} //= 0;

    my @opts_expose = (@{$conf->{expose}}, @{$opts{expose} //= []});
    if (@opts_expose) {
      my $opts_expose = join ", ", @opts_expose;
      $h->header('Access-Control-Expose-Headers' => $opts_expose);
    }

    $app->log->debug("Allow CORS Origin '$origin'");

    return $next->();
  });

  # CORS Under
  $app->routes->add_shortcut(under_cors => sub {
    my ($r, @args) = @_;

    $r->under(@args)->to(
      cb => sub {
        my ($c) = @_;

        # Not a CORS request, success
        return 1 unless defined $c->req->headers->origin;

        my %opts = $route_opts->($c->match->endpoint);

        # Route configured for CORS, success
        return 1 if @{$opts{origin} //= []};

        $c->render(status => 403, text => "CORS Forbidden");
        $app->log->debug("Forbidden CORS request");

        return; # Fail
      }
    );
  });

  # CORS Preflight
  $app->routes->add_shortcut(cors => sub {
    my ($r, @args) = @_;

    $r->route(@args)->options->over(
      headers => {
        'Origin' => qr/\S/ms,
        'Access-Control-Request-Method' => qr/\S/ms
      }
    )->to(
      cb => sub {
        my ($c) = @_;

        my %opts = $route_opts->($c->match->endpoint);

        my @opts_origin = @{$opts{origin} //= []};
        return $c->render(status => 204, data => '')
          unless @opts_origin;

        my $h = $c->res->headers;
        $h->append('Vary' => 'Origin');

        my $origin = $check_origin->($c, @opts_origin);
        return $c->render(status => 204, data => '')
          unless defined $origin;

        my @opts_methods = @{$opts{methods} //= []};
        push @opts_methods, 'HEAD'
          if grep { uc $_ eq 'GET' } @opts_methods
            and not grep { uc $_ eq 'HEAD' } @opts_methods;
        return $c->render(status => 204, data => '')
          unless @opts_methods;

        my $methods = $check_methods->($c, @opts_methods);
        return $c->render(status => 204, data => '')
          unless defined $methods;

        my @opts_headers = @{$opts{headers} //= []};

        my $headers = $check_headers->($c, @opts_headers);
        return $c->render(status => 204, data => '')
          unless defined $headers;

        $h->header('Access-Control-Allow-Origin'  => $origin);
        $h->header('Access-Control-Allow-Methods' => $methods);

        $h->header('Access-Control-Allow-Headers' => $headers)
          if $headers;

        $h->header('Access-Control-Allow-Credentials' => 'true')
          if $opts{credentials} //= 0;

        $h->header('Access-Control-Max-Age' => $conf->{max_age});

        $app->log->debug("Accept CORS '$origin' => '$methods'");

        return $c->render(status => 204, data => '');
      }
    );
  });
}

1;

__END__