Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Allow multiple origins for header Access-Control-Allow-Origin #8517

Merged
merged 10 commits into from
May 1, 2023
Merged

feat: Allow multiple origins for header Access-Control-Allow-Origin #8517

merged 10 commits into from
May 1, 2023

Conversation

MarcDerhammer
Copy link
Contributor

Pull Request

Issue

Closes: #8516

Approach

Let the allowOrigin config accept a list of origins and match to the request header if found

Tasks

  • Add tests
  • Add changes to documentation (guides, repository pages, code comments)

@parse-github-assistant
Copy link

Thanks for opening this pull request!

mtrezza
mtrezza requested changes Apr 27, 2023
View reviewed changes
src/Options/docs.js Outdated Show resolved Hide resolved
@codecov
Copy link

codecov bot commented Apr 27, 2023 •
edited
Loading

Codecov Report

Patch coverage: 100.00% and project coverage change: -0.03 ⚠️

Comparison is base (9e43bc2) 94.35% compared to head (657543c) 94.32%.

❗ Current head 657543c differs from pull request most recent head 32123ba. Consider uploading reports for the commit 32123ba to get more accurate results

Additional details and impacted files 
@@            Coverage Diff             @@
##            alpha    #8517      +/-   ##
==========================================
- Coverage   94.35%   94.32%   -0.03%     
==========================================
  Files         183      183              
  Lines       14515    14517       +2     
==========================================
- Hits        13695    13693       -2     
- Misses        820      824       +4
Impacted Files Coverage Δ
src/Options/Definitions.js 100.00% <ø> (ø)
src/Options/index.js 100.00% <ø> (ø)
src/middlewares.js 97.00% <100.00%> (+0.01%) ⬆️

... and 5 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

mtrezza
mtrezza requested changes Apr 27, 2023
View reviewed changes
src/Options/index.js Outdated Show resolved Hide resolved
src/middlewares.js Outdated Show resolved Hide resolved
MarcDerhammer and others added 5 commits April 27, 2023 17:23
@MarcDerhammer @mtrezza
Update src/Options/index.js
5aabe94 
Co-authored-by: Manuel <5673677+mtrezza@users.noreply.github.com>
Signed-off-by: Marc Derhammer <marc.derhammer@gmail.com>
@MarcDerhammer @mtrezza
Update src/middlewares.js
8a99d90 
Co-authored-by: Manuel <5673677+mtrezza@users.noreply.github.com>
Signed-off-by: Marc Derhammer <marc.derhammer@gmail.com>
@MarcDerhammer
Update definitions
4b24372
@MarcDerhammer
Fix for single origin as a string
4d16a39
@MarcDerhammer
Removed test for comma delimited string option
1db0af1
mtrezza
mtrezza approved these changes Apr 28, 2023
View reviewed changes
Copy link
Member

@mtrezza mtrezza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, let's wait for the CI to pass...

@mtrezza mtrezza changed the title feat: Allow multiple origins feat: Allow multiple origins for header Access-Control-Allow-Origin May 1, 2023
@mtrezza mtrezza merged commit 4f15539 into parse-community:alpha May 1, 2023
parseplatformorg pushed a commit that referenced this pull request May 1, 2023
@semantic-release-bot
chore(release): 6.1.0-alpha.8 [skip ci]
2f53c80 
# [6.1.0-alpha.8](6.1.0-alpha.7...6.1.0-alpha.8) (2023-05-01)

### Features

* Allow multiple origins for header `Access-Control-Allow-Origin` ([#8517](#8517)) ([4f15539](4f15539))
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 6.1.0-alpha.8

@parseplatformorg parseplatformorg added the state:released-alpha Released as alpha version label May 1, 2023
parseplatformorg pushed a commit that referenced this pull request May 1, 2023
@semantic-release-bot
chore(release): 6.1.0-beta.2 [skip ci]
f59d46c 
# [6.1.0-beta.2](6.1.0-beta.1...6.1.0-beta.2) (2023-05-01)

### Bug Fixes

* LiveQuery can return incorrectly formatted date ([#8456](#8456)) ([4ce135a](4ce135a))
* Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([#8446](#8446)) ([22d2446](22d2446))
* Parameters missing in `afterFind` trigger of authentication adapters ([#8458](#8458)) ([ce34747](ce34747))
* Rate limiting across multiple servers via Redis not working ([#8469](#8469)) ([d9e347d](d9e347d))

### Features

* Add `afterFind` trigger to authentication adapters ([#8444](#8444)) ([c793bb8](c793bb8))
* Add rate limiting across multiple servers via Redis ([#8394](#8394)) ([34833e4](34833e4))
* Allow multiple origins for header `Access-Control-Allow-Origin` ([#8517](#8517)) ([4f15539](4f15539))
* Export `AuthAdapter` to make it available for extension with custom authentication adapters ([#8443](#8443)) ([40c1961](40c1961))
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 6.1.0-beta.2

@parseplatformorg parseplatformorg added the state:released-beta Released as beta version label May 1, 2023
parseplatformorg pushed a commit that referenced this pull request May 1, 2023
@semantic-release-bot
chore(release): 6.1.0 [skip ci]
832702d 
# [6.1.0](6.0.0...6.1.0) (2023-05-01)

### Bug Fixes

* LiveQuery can return incorrectly formatted date ([#8456](#8456)) ([4ce135a](4ce135a))
* Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([#8446](#8446)) ([22d2446](22d2446))
* Parameters missing in `afterFind` trigger of authentication adapters ([#8458](#8458)) ([ce34747](ce34747))
* Rate limiting across multiple servers via Redis not working ([#8469](#8469)) ([d9e347d](d9e347d))
* Security upgrade jsonwebtoken to 9.0.0 ([#8420](#8420)) ([f5bfe45](f5bfe45))

### Features

* Add `afterFind` trigger to authentication adapters ([#8444](#8444)) ([c793bb8](c793bb8))
* Add option `schemaCacheTtl` for schema cache pulling as alternative to `enableSchemaHooks` ([#8436](#8436)) ([b3b76de](b3b76de))
* Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([#7551](#7551)) ([e5d610e](e5d610e))
* Add rate limiting across multiple servers via Redis ([#8394](#8394)) ([34833e4](34833e4))
* Allow multiple origins for header `Access-Control-Allow-Origin` ([#8517](#8517)) ([4f15539](4f15539))
* Deprecate LiveQuery `fields` option in favor of `keys` for semantic consistency ([#8388](#8388)) ([a49e323](a49e323))
* Export `AuthAdapter` to make it available for extension with custom authentication adapters ([#8443](#8443)) ([40c1961](40c1961))
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 6.1.0

@parseplatformorg parseplatformorg added the state:released Released as stable version label May 1, 2023
mtrezza added a commit to mtrezza/parse-server that referenced this pull request Jun 10, 2023
@mtrezza
Squashed commit of the following:
ef75726 
commit 1506273
Author: semantic-release-bot <semantic-release-bot@martynus.net>
Date:   Sat May 20 23:24:03 2023 +0000

    chore(release): 6.2.0 [skip ci]

    # [6.2.0](parse-community/parse-server@6.1.0...6.2.0) (2023-05-20)

    ### Features

    * Add new Parse Server option `fileUpload.fileExtensions` to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern `^[^hH][^tT][^mM][^lL]?$`, which excludes HTML files; if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to `['.*']` ([parse-community#8538](parse-community#8538)) ([a318e7b](parse-community@a318e7b))

commit a318e7b
Author: Manuel <5673677+mtrezza@users.noreply.github.com>
Date:   Sun May 21 01:23:00 2023 +0200

    feat: Add new Parse Server option `fileUpload.fileExtensions` to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern `^[^hH][^tT][^mM][^lL]?$`, which excludes HTML files; if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to `['.*']` (parse-community#8538)

commit 832702d
Author: semantic-release-bot <semantic-release-bot@martynus.net>
Date:   Mon May 1 21:50:23 2023 +0000

    chore(release): 6.1.0 [skip ci]

    # [6.1.0](parse-community/parse-server@6.0.0...6.1.0) (2023-05-01)

    ### Bug Fixes

    * LiveQuery can return incorrectly formatted date ([parse-community#8456](parse-community#8456)) ([4ce135a](parse-community@4ce135a))
    * Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([parse-community#8446](parse-community#8446)) ([22d2446](parse-community@22d2446))
    * Parameters missing in `afterFind` trigger of authentication adapters ([parse-community#8458](parse-community#8458)) ([ce34747](parse-community@ce34747))
    * Rate limiting across multiple servers via Redis not working ([parse-community#8469](parse-community#8469)) ([d9e347d](parse-community@d9e347d))
    * Security upgrade jsonwebtoken to 9.0.0 ([parse-community#8420](parse-community#8420)) ([f5bfe45](parse-community@f5bfe45))

    ### Features

    * Add `afterFind` trigger to authentication adapters ([parse-community#8444](parse-community#8444)) ([c793bb8](parse-community@c793bb8))
    * Add option `schemaCacheTtl` for schema cache pulling as alternative to `enableSchemaHooks` ([parse-community#8436](parse-community#8436)) ([b3b76de](parse-community@b3b76de))
    * Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([parse-community#7551](parse-community#7551)) ([e5d610e](parse-community@e5d610e))
    * Add rate limiting across multiple servers via Redis ([parse-community#8394](parse-community#8394)) ([34833e4](parse-community@34833e4))
    * Allow multiple origins for header `Access-Control-Allow-Origin` ([parse-community#8517](parse-community#8517)) ([4f15539](parse-community@4f15539))
    * Deprecate LiveQuery `fields` option in favor of `keys` for semantic consistency ([parse-community#8388](parse-community#8388)) ([a49e323](parse-community@a49e323))
    * Export `AuthAdapter` to make it available for extension with custom authentication adapters ([parse-community#8443](parse-community#8443)) ([40c1961](parse-community@40c1961))

commit 18b63d1
Merge: f7eee19 f59d46c
Author: Manuel <5673677+mtrezza@users.noreply.github.com>
Date:   Mon May 1 23:49:22 2023 +0200

    build: Release (parse-community#8526)
mtrezza added a commit to mtrezza/parse-server that referenced this pull request Jun 10, 2023
@mtrezza
Squashed commit of the following:
24c0b03 
commit 1506273
Author: semantic-release-bot <semantic-release-bot@martynus.net>
Date:   Sat May 20 23:24:03 2023 +0000

    chore(release): 6.2.0 [skip ci]

    # [6.2.0](parse-community/parse-server@6.1.0...6.2.0) (2023-05-20)

    ### Features

    * Add new Parse Server option `fileUpload.fileExtensions` to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern `^[^hH][^tT][^mM][^lL]?$`, which excludes HTML files; if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to `['.*']` ([parse-community#8538](parse-community#8538)) ([a318e7b](parse-community@a318e7b))

commit a318e7b
Author: Manuel <5673677+mtrezza@users.noreply.github.com>
Date:   Sun May 21 01:23:00 2023 +0200

    feat: Add new Parse Server option `fileUpload.fileExtensions` to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern `^[^hH][^tT][^mM][^lL]?$`, which excludes HTML files; if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to `['.*']` (parse-community#8538)

commit 832702d
Author: semantic-release-bot <semantic-release-bot@martynus.net>
Date:   Mon May 1 21:50:23 2023 +0000

    chore(release): 6.1.0 [skip ci]

    # [6.1.0](parse-community/parse-server@6.0.0...6.1.0) (2023-05-01)

    ### Bug Fixes

    * LiveQuery can return incorrectly formatted date ([parse-community#8456](parse-community#8456)) ([4ce135a](parse-community@4ce135a))
    * Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([parse-community#8446](parse-community#8446)) ([22d2446](parse-community@22d2446))
    * Parameters missing in `afterFind` trigger of authentication adapters ([parse-community#8458](parse-community#8458)) ([ce34747](parse-community@ce34747))
    * Rate limiting across multiple servers via Redis not working ([parse-community#8469](parse-community#8469)) ([d9e347d](parse-community@d9e347d))
    * Security upgrade jsonwebtoken to 9.0.0 ([parse-community#8420](parse-community#8420)) ([f5bfe45](parse-community@f5bfe45))

    ### Features

    * Add `afterFind` trigger to authentication adapters ([parse-community#8444](parse-community#8444)) ([c793bb8](parse-community@c793bb8))
    * Add option `schemaCacheTtl` for schema cache pulling as alternative to `enableSchemaHooks` ([parse-community#8436](parse-community#8436)) ([b3b76de](parse-community@b3b76de))
    * Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([parse-community#7551](parse-community#7551)) ([e5d610e](parse-community@e5d610e))
    * Add rate limiting across multiple servers via Redis ([parse-community#8394](parse-community#8394)) ([34833e4](parse-community@34833e4))
    * Allow multiple origins for header `Access-Control-Allow-Origin` ([parse-community#8517](parse-community#8517)) ([4f15539](parse-community@4f15539))
    * Deprecate LiveQuery `fields` option in favor of `keys` for semantic consistency ([parse-community#8388](parse-community#8388)) ([a49e323](parse-community@a49e323))
    * Export `AuthAdapter` to make it available for extension with custom authentication adapters ([parse-community#8443](parse-community#8443)) ([40c1961](parse-community@40c1961))

commit 18b63d1
Merge: f7eee19 f59d46c
Author: Manuel <5673677+mtrezza@users.noreply.github.com>
Date:   Mon May 1 23:49:22 2023 +0200

    build: Release (parse-community#8526)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mtrezza mtrezza mtrezza approved these changes

Assignees
No one assigned
Labels
state:released Released as stable version state:released-alpha Released as alpha version state:released-beta Released as beta version
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

CORS allow multiple domains
3 participants
@MarcDerhammer @parseplatformorg @mtrezza