worldmonitor/api/_cors.js at main · NhoThoang/worldmonitor

Repository navigation

const ALLOWED_ORIGIN_PATTERNS = [

/^https:\/\/(.*\.)?worldmonitor\.app$/,

/^https:\/\/worldmonitor-[a-z0-9-]+-elie-[a-z0-9]+\.vercel\.app$/,

/^https?:\/\/localhost(:\d+)?$/,

/^https?:\/\/127\.0\.0\.1(:\d+)?$/,

/^https?:\/\/tauri\.localhost(:\d+)?$/,

/^https?:\/\/[a-z0-9-]+\.tauri\.localhost(:\d+)?$/i,

/^tauri:\/\/localhost$/,

/^asset:\/\/localhost$/,

];

function isAllowedOrigin(origin) {

return Boolean(origin) && ALLOWED_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));

}

export function getCorsHeaders(req, methods = 'GET, OPTIONS') {

const origin = req.headers.get('origin') || '';

const allowOrigin = isAllowedOrigin(origin) ? origin : 'https://worldmonitor.app';

return {

'Access-Control-Allow-Origin': allowOrigin,

'Access-Control-Allow-Methods': methods,

'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-WorldMonitor-Key',

'Access-Control-Max-Age': '86400',

'Vary': 'Origin',

};

}

export function isDisallowedOrigin(req) {

const origin = req.headers.get('origin');

if (!origin) return false;

return !isAllowedOrigin(origin);

}