fix: Cors headers (#119)

* fix: Cors header by default '*'

* feat: Pass CLI option for cors headers

* refactor: Change description of cors option

src/commands/serve.js

@@ -39,6 +39,10 @@ export default asyncCommand({
 			description: 'Port to start a server on.',
 			defaultDescription: 'PORT || 8080',
 			alias: 'p'
+		},
+		cors: {
+			description: 'Set allowed origins',
+			defaultDescription: 'https://localhost:${PORT}'
 		}
 	},
 
@@ -79,12 +83,15 @@ async function serve(options) {
 	configFile = await tmpFile({ postfix: '.json' });
 	await fs.writeFile(configFile, JSON.stringify(config));
 
+	let port = options.port || process.env.PORT || 8080;
+
 	await serveHttp2({
 		options,
 		config: configFile,
 		configObj: config,
 		server: options.server,
-		port: options.port || process.env.PORT || 8080,
+		cors: options.cors || `https://localhost:${port}`,
+		port,
 		dir,
 		cwd: path.resolve(__dirname, '../resources')
 	});
@@ -184,19 +191,20 @@ const SERVERS = {
 			options.cwd = persistencePath('preact-cli');
 			process.stderr.write(`Falling back to shared directory + simplehttp2server.\n(dir: ${options.cwd})\n`);
 		}
+
 		return [
 			simplehttp2server,
-			'-cors', '*',
+			'-cors', options.cors,
 			'-config', options.config,
-			'-listen', `:${options.port || 8080}`
+			'-listen', `:${options.port}`
 		];
 	},
 	superstatic(options) {
 		return [
 			'superstatic',
 			path.relative(options.cwd, options.dir),
 			'--gzip',
-			'-p', options.port || 8080,
+			'-p', options.port,
 			'-c', JSON.stringify({ ...options.configObj, public: undefined })
 		];
 	},

src/resources/static-app.json

@@ -13,10 +13,6 @@
           "key": "Cache-Control",
           "value": "public, max-age=3600, no-cache"
         },
-        {
-          "key": "Access-Control-Allow-Origin",
-          "value": "*"
-        },
         {
           "key": "Access-Control-Max-Age",
           "value": "600"