Archives/gristlabs_grist-core
1
0
Fork 0
mirror of https://github.com/gristlabs/grist-core.git synced 2026-03-02 04:09:24 +00:00
Code Issues Projects Releases Wiki Activity

Add function to allow hosts from environment variables (#287)

Browse Source 
* Add allowed host option to handle CORS requests
* Update readme with new GRIST_ALLOWED_HOSTS environment variable
This commit is contained in:
Louis Delbosc
2022-09-28 18:33:53 +02:00
committed by GitHub
parent 9e681677a3
commit 49b1749e98
5 changed files with 39 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
test/server/lib/DocApi.ts
View File

@@ -2773,6 +2773,23 @@ function testDocApi() {
});
});
describe("Allowed Origin", () => {
it('should allow only example.com', async () => {
async function checkOrigin(origin: string, status: number, error?: string) {
const resp = await axios.get(`${serverUrl}/api/docs/${docIds.Timesheets}/`,
{...chimpy, headers: {...chimpy.headers, "Origin": origin}}
);
error && assert.deepEqual(resp.data, {error});
assert.equal(resp.status, status);
}
await checkOrigin("https://www.toto.com", 500, "Unrecognized origin");
await checkOrigin("https://badexample.com", 500, "Unrecognized origin");
await checkOrigin("https://bad.com/example.com/toto", 500, "Unrecognized origin");
await checkOrigin("https://example.com/path", 200);
await checkOrigin("https://good.example.com/toto", 200);
})
})
// PLEASE ADD MORE TESTS HERE
}
@@ -2866,6 +2883,7 @@ class TestServer {
REDIS_URL: process.env.TEST_REDIS_URL,
APP_HOME_URL: _homeUrl,
ALLOWED_WEBHOOK_DOMAINS: `example.com,localhost:${webhooksTestPort}`,
GRIST_ALLOWED_HOSTS: `example.com,localhost:${webhooksTestPort}`,
...process.env
};