Fix CORS preflight handling and origin matching

- Add OPTIONS handler to respond 204 to preflight requests; without
  it they fell through to the 404 handler
- Fix origin matching in findMatchingOrigin to use exact equality
  instead of the inverted substring check that caused subdomains to
  be rejected
- Expand auto-origin FQDNs to http/https variants to match the Origin
  header format browsers send
- Remove the host header fallback, which matched the destination not
  the source and had no intentional rationale
- Replace node-fetch with native fetch in tests, which is now possible
  since tests send Origin instead of Host

Author: electerious

package-lock.json

@@ -64,7 +64,6 @@
     "is-url": "^1.2.4",
     "is-valid-domain": "^0.1.6",
     "mongoose": "^9.2.1",
-    "node-fetch": "^3.3.2",
     "node-schedule": "^2.1.1",
     "normalize-url": "^9.0.0",
     "request-ip": "^3.3.0",

package.json

@@ -69,6 +69,11 @@ const apolloServer = createApolloServer({
 // Apply CORS middleware
 app.use(attachCorsHeaders)
 
+// Respond to preflight requests
+app.options('/{*path}', (request, response) => {
+  response.sendStatus(204)
+})
+
 // Serve static files
 app.get('/', async (request, response) => {
   response.setHeader('Content-Type', 'text/html; charset=utf-8')

src/server.js

@@ -1,12 +1,13 @@
 import fullyQualifiedDomainNames from './fullyQualifiedDomainNames.js'
 
 const findOrigin = (request, origins) => {
-  return origins.find((origin) => origin.includes(request.headers.origin) || origin.includes(request.headers.host))
+  return origins.find((origin) => origin === request.headers.origin)
 }
 
 export default async (request, allowedOrigins, autoOrigin) => {
   if (autoOrigin === true) {
-    const origins = await fullyQualifiedDomainNames()
+    const names = await fullyQualifiedDomainNames()
+    const origins = names.flatMap((name) => [`http://${name}`, `https://${name}`])
     return findOrigin(request, origins)
   }
 

src/utils/findMatchingOrigin.js

@@ -1,14 +1,10 @@
-import fetch from 'node-fetch'
-
 export const api = async (base, body, token, headers = {}) => {
   const url = new URL('/api', await base)
 
   const defaultHeaders = {}
   defaultHeaders['Content-Type'] = 'application/json'
   defaultHeaders['Authorization'] = token == null ? undefined : `Bearer ${token}`
 
-  // Use node-fetch as the built-in fetch does not support modifying the Host header,
-  // which is required for some tests.
   const result = await fetch(url.href, {
     method: 'post',
     body: JSON.stringify(body),

test/_utils.js

@@ -25,14 +25,18 @@ test('return cors headers based on fully qualifed domain names', async (t) => {
     ACKEE_AUTO_ORIGIN: 'true',
   })
 
-  const { headers: fqdnHeaders } = await api(base, { query: '{ __typename }' }, null, { Host: 'fqdn.example.com' })
+  const { headers: fqdnHeaders } = await api(base, { query: '{ __typename }' }, null, {
+    Origin: 'https://fqdn.example.com',
+  })
 
-  t.is(fqdnHeaders.get('Access-Control-Allow-Origin'), 'fqdn.example.com')
+  t.is(fqdnHeaders.get('Access-Control-Allow-Origin'), 'https://fqdn.example.com')
   t.is(fqdnHeaders.get('Access-Control-Allow-Methods'), 'GET, POST, PATCH, OPTIONS')
   t.is(fqdnHeaders.get('Access-Control-Allow-Headers'), 'Content-Type, Authorization, Time-Zone')
   t.is(fqdnHeaders.get('Access-Control-Allow-Credentials'), 'true')
 
-  const { headers: noFqdnHeaders } = await api(base, { query: '{ __typename }' }, null, { Host: 'No fqdn' })
+  const { headers: noFqdnHeaders } = await api(base, { query: '{ __typename }' }, null, {
+    Origin: 'https://not-in-list.example.com',
+  })
 
   t.is(noFqdnHeaders.get('Access-Control-Allow-Origin'), null)
   t.is(noFqdnHeaders.get('Access-Control-Allow-Methods'), null)

test/serverWithAutoCors.js

@@ -20,7 +20,7 @@ test('return cors headers if env var specifies one', async (t) => {
     ACKEE_ALLOW_ORIGIN: origin,
   })
 
-  const { headers } = await api(base, { query: '{ __typename }' })
+  const { headers } = await api(base, { query: '{ __typename }' }, null, { Origin: origin })
 
   t.is(headers.get('Access-Control-Allow-Origin'), origin)
   t.is(headers.get('Access-Control-Allow-Methods'), 'GET, POST, PATCH, OPTIONS')

test/serverWithCors.js

@@ -20,7 +20,7 @@ test('return cors headers with corresponding origin if env var specifies multipl
     ACKEE_ALLOW_ORIGIN: `https://example.com,${origin}`,
   })
 
-  const { headers } = await api(base, { query: '{ __typename }' })
+  const { headers } = await api(base, { query: '{ __typename }' }, null, { Origin: origin })
 
   t.is(headers.get('Access-Control-Allow-Origin'), origin)
   t.is(headers.get('Access-Control-Allow-Methods'), 'GET, POST, PATCH, OPTIONS')