feat(core): set access-control-allow-origin header to prevent abuse

lib/middleware/header.js

@@ -2,8 +2,6 @@ const etagCalculate = require('etag');
 const logger = require('../utils/logger');
 const config = require('../config');
 const headers = {
-    'Access-Control-Allow-Origin': '*',
-    'Access-Control-Allow-Headers': 'Content-Type, Content-Length, Authorization, Accept, X-Requested-With',
     'Access-Control-Allow-Methods': 'GET',
     'Content-Type': 'application/xml; charset=utf-8',
     'Cache-Control': `public, max-age=${config.cacheExpire}`,
@@ -12,6 +10,9 @@ const headers = {
 module.exports = async (ctx, next) => {
     logger.info(`${ctx.url}, user IP: ${ctx.ips[0] || ctx.ip}`);
     ctx.set(headers);
+    ctx.set({
+        'Access-Control-Allow-Origin': `${ctx.host}`,
+    });
 
     await next();
 

test/middleware/header.js

@@ -10,7 +10,7 @@ afterAll(() => {
 describe('header', () => {
     it(`header`, async () => {
         const response = await request.get('/test/1');
-        expect(response.headers['access-control-allow-origin']).toBe('*');
+        expect(response.headers['access-control-allow-origin']).toBe('127.0.0.1:1200');
         expect(response.headers['access-control-allow-headers']).toBe('Content-Type, Content-Length, Authorization, Accept, X-Requested-With');
         expect(response.headers['access-control-allow-methods']).toBe('GET');
         expect(response.headers['content-type']).toBe('application/xml; charset=utf-8');