@@ -655,42 +655,32 @@ function set_cors_headers(req, res, cors) {
655655 * @param {CORSRule[] } cors_rules
656656 */
657657function set_cors_headers_s3 ( req , res , cors_rules ) {
658- if ( config . S3_CORS_ENABLED ) {
658+ if ( ! config . S3_CORS_ENABLED || ! cors_rules ) return ;
659+
660+ // based on https://docs.aws.amazon.com/AmazonS3/latest/userguide/cors.html
661+ const match_method = req . headers [ 'access-control-request-method' ] || req . method ;
662+ const match_origin = req . headers . origin ;
663+ const match_header = req . headers [ 'access-control-request-headers' ] ; // not a must
664+ const matched_rule = req . headers . origin && ( // find the first rule with origin and method match
665+ cors_rules . find ( rule => {
666+ const allowed_origins_regex = rule . allowed_origins . map ( r => RegExp ( `^${ r . replace ( / \* / g, '.*' ) } ) ) ;
667+ const allowed_headers_regex = rule . allowed_headers ?. map ( r => RegExp ( `^${ r . replace ( / \* / g, '.*' ) } ) ) ;
668+ return allowed_origins_regex . some ( r => r . test ( match_origin ) ) &&
669+ rule . allowed_methods . includes ( match_method ) &&
670+ // we can match if no request headers or if reuqest headers match the rule allowed headers
671+ ( ! match_header || allowed_headers_regex ?. some ( r => r . test ( match_header ) ) ) ;
672+ } ) ) ;
673+ if ( matched_rule ) {
674+ // https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html
659675 set_cors_headers ( req , res , {
660- allow_origin : config . S3_CORS_ALLOW_ORIGIN ,
661- allow_credentials : config . S3_CORS_ALLOW_CREDENTIAL ,
662- allow_methods : config . S3_CORS_ALLOW_METHODS ,
663- allow_headers : config . S3_CORS_ALLOW_HEADERS ,
664- expose_headers : config . STS_CORS_EXPOSE_HEADERS ,
676+ allow_origin : matched_rule . allowed_origins . includes ( '*' ) ? '*' : req . headers . origin ,
677+ allow_methods : matched_rule . allowed_methods . join ( ',' ) ,
678+ allow_headers : matched_rule . allowed_headers ?. join ( ',' ) ,
679+ expose_headers : matched_rule . expose_headers ?. join ( ',' ) ,
680+ allow_credentials : 'true' ,
681+ max_age : matched_rule ?. max_age
665682 } ) ;
666683 }
667- // CORS CURRENTLY BREAKS OBJECT BROWSER - WILL ONLY SUPPORT DEFAULT HEADERS FOR NOW
668- // if (!config.S3_CORS_ENABLED || !cors_rules) return;
669-
670- // // based on https://docs.aws.amazon.com/AmazonS3/latest/userguide/cors.html
671- // const match_method = req.headers['access-control-request-method'] || req.method;
672- // const match_origin = req.headers.origin;
673- // const match_header = req.headers['access-control-request-headers']; // not a must
674- // const matched_rule = req.headers.origin && ( // find the first rule with origin and method match
675- // cors_rules.find(rule => {
676- // const allowed_origins_regex = rule.allowed_origins.map(r => RegExp(`^${r.replace(/\*/g, '.*')}$`));
677- // const allowed_headers_regex = rule.allowed_headers?.map(r => RegExp(`^${r.replace(/\*/g, '.*')}$`));
678- // return allowed_origins_regex.some(r => r.test(match_origin)) &&
679- // rule.allowed_methods.includes(match_method) &&
680- // // we can match if no request headers or if reuqest headers match the rule allowed headers
681- // (!match_header || allowed_headers_regex?.some(r => r.test(match_header)));
682- // }));
683- // if (matched_rule) {
684- // // https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html
685- // set_cors_headers(req, res, {
686- // allow_origin: matched_rule.allowed_origins.includes('*') ? '*' : req.headers.origin,
687- // allow_methods: matched_rule.allowed_methods.join(','),
688- // allow_headers: matched_rule.allowed_headers?.join(','),
689- // expose_headers: matched_rule.expose_headers?.join(','),
690- // allow_credentials: 'true',
691- // max_age: matched_rule?.max_age
692- // });
693- // }
694684}
695685
696686/**
0 commit comments