sasjs/server
1
0
Fork 0
mirror of https://github.com/sasjs/server.git synced 2026-01-16 18:30:06 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #97 from sasjs/issue-96

Browse Source 
feat(cors): whitelisting is configurable through .env variables
This commit is contained in:
Muhammad Saad
2022-03-21 18:21:39 +05:00
committed by GitHub
parent b0fb858c49 534e4e5bf3
commit 2c34395110
3 changed files with 36 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
README.md
View File

@@ -48,16 +48,32 @@ When launching the app, it will make use of specific environment variables. Thes
Example contents of a `.env` file:
```
MODE=desktop # options: [desktop|server] default: desktop
CORS=disable # options: [disable|enable] default: disable
MODE=desktop # options: [desktop|server] default: `desktop`
CORS=disable # options: [disable|enable] default: `disable` for `server` & `enable` for `desktop`
WHITELIST= # options: <http://localhost:3000 https://abc.com ...> space separated urls
PROTOCOL=http # options: [http|https] default: http
PORT=5000 # default: 5000
PORT_WEB=3000 # port for sasjs web component(react). default: 3000
# optional
# for MODE: `desktop`, prompts user
# for MODE: `server` gets value from api/package.json `configuration.sasPath`
SAS_PATH=/path/to/sas/executable.exe
# optional
# for MODE: `desktop`, prompts user
# for MODE: `server` defaults to /tmp
DRIVE_PATH=/tmp
PROTOCOL=http # options: [http|https] default: http
# ENV variables required for PROTOCOL: `https`
PRIVATE_KEY=privkey.pem
FULL_CHAIN=fullchain.pem
# ENV variables required for MODE: `server`
ACCESS_TOKEN_SECRET=<secret>
REFRESH_TOKEN_SECRET=<secret>
AUTH_CODE_SECRET=<secret>
DB_CONNECT=mongodb+srv://<DB_USERNAME>:<DB_PASSWORD>@<CLUSTER>/<DB_NAME>?retryWrites=true&w=majority
```
## Persisting the Session
@@ -94,11 +110,10 @@ Instead of `app_name` you can pass:
- `all` to act on all processes
- `id` to act on a specific process id
## Server Version
The following credentials can be used for the initial connection to SASjs/server. It is recommended to change these on first use.
The following credentials can be used for the initial connection to SASjs/server. It is recommended to change these on first use.
* CLIENTID: `clientID1`
* USERNAME: `secretuser`
* PASSWORD: `secretpassword`
- CLIENTID: `clientID1`
- USERNAME: `secretuser`
- PASSWORD: `secretpassword`

4
api/.env.example
View File

@@ -1,10 +1,10 @@
MODE=[desktop|server] default considered as desktop
CORS=[disable|enable] default considered as disable
CORS=[disable|enable] default considered as disable for server MODE & enable for desktop MODE
WHITELIST=<space separated urls, each starting with protocol `http` or `https`>
PROTOCOL=[http|https] default considered as http
PRIVATE_KEY=privkey.pem
FULL_CHAIN=fullchain.pem
PORT=[5000] default value is 5000
PORT_WEB=[port for sasjs web component(react)] default value is 3000
ACCESS_TOKEN_SECRET=<secret>
REFRESH_TOKEN_SECRET=<secret>
AUTH_CODE_SECRET=<secret>

15
api/src/app.ts
View File

@@ -16,14 +16,17 @@ dotenv.config()
const app = express()
const { MODE, CORS, PORT_WEB } = process.env
const whiteList = [
`http://localhost:${PORT_WEB ?? 3000}`,
'https://sas.analytium.co.uk:8343'
]
const { MODE, CORS, WHITELIST } = process.env
if (MODE?.trim() !== 'server' || CORS?.trim() === 'enable') {
console.log('All CORS Requests are enabled')
const whiteList: string[] = []
WHITELIST?.split(' ')?.forEach((url) => {
if (url.startsWith('http'))
// removing trailing slash of URLs listing for CORS
whiteList.push(url.replace(/\/$/, ''))
})
console.log('All CORS Requests are enabled for:', whiteList)
app.use(cors({ credentials: true, origin: whiteList }))
}