mirror of
https://github.com/movixcorp/MovixOpenSource.git
synced 2026-07-26 20:42:08 +00:00
2045dbd2c9
Modification du Oauth : Pouvoir manager les apps depuis le panel admin Correction de l'affichage des images des admins Majs des urls extension, userscript et premid Correction d'un crash sur les commentaires Ajout d'un light mode sur le frontend
73 lines
1.7 KiB
JavaScript
73 lines
1.7 KiB
JavaScript
/**
|
|
* CORS middleware configuration.
|
|
* Extracted from server.js -- restricted origin policy.
|
|
*/
|
|
|
|
const cors = require("cors");
|
|
const { getOAuthAllowedCorsOrigins } = require('../utils/oauthClients');
|
|
|
|
const STATIC_ALLOWED_DOMAINS = [
|
|
'movix.tax',
|
|
'movix.cash',
|
|
'movix.blog',
|
|
'movix.rodeo',
|
|
'movix.club',
|
|
'movix.site',
|
|
'movix11.pages.dev',
|
|
'nakios.site',
|
|
'cinezo.site',
|
|
'filmib.cc'
|
|
];
|
|
|
|
function isAllowedStaticOrigin(origin) {
|
|
try {
|
|
const parsedOrigin = new URL(origin);
|
|
const hostname = parsedOrigin.hostname;
|
|
|
|
return STATIC_ALLOWED_DOMAINS.some((domain) => (
|
|
hostname === domain || hostname.endsWith(`.${domain}`)
|
|
));
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function isAllowedOAuthOrigin(origin) {
|
|
return getOAuthAllowedCorsOrigins().includes(origin);
|
|
}
|
|
|
|
const corsMiddleware = cors({
|
|
origin: (origin, callback) => {
|
|
// Allow requests with no origin (like mobile apps or curl requests)
|
|
if (!origin) return callback(null, true);
|
|
|
|
// Allow all localhost requests in development only
|
|
if (process.env.NODE_ENV !== 'production' && origin.match(/^https?:\/\/localhost(:[0-9]+)?$/)) {
|
|
return callback(null, true);
|
|
}
|
|
|
|
if (isAllowedStaticOrigin(origin) || isAllowedOAuthOrigin(origin)) {
|
|
callback(null, true);
|
|
} else {
|
|
callback(new Error("Not allowed by CORS"));
|
|
}
|
|
},
|
|
methods: ["GET", "POST", "OPTIONS", "PUT", "DELETE", "PATCH", "HEAD"],
|
|
allowedHeaders: [
|
|
"Content-Type",
|
|
"Authorization",
|
|
"X-Requested-With",
|
|
"Accept",
|
|
"Origin",
|
|
"X-No-Compression",
|
|
"Access-Control-Request-Headers",
|
|
"baggage",
|
|
"sentry-trace",
|
|
"x-profile-id",
|
|
"x-access-key",
|
|
],
|
|
credentials: true,
|
|
optionsSuccessStatus: 204,
|
|
});
|
|
|
|
module.exports = corsMiddleware;
|