Weishen/Hydro
2
0 Fork 0
mirror of https://gitcode.com/gh_mirrors/hy/Hydro.git synced 2026-10-19 17:38:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

framework: also allow cors from referer header

Browse Source
This commit is contained in:
undefined committed 2026-04-05 23:13:14 +08:00
1 parent 9c10219ecb
commit 232c066d22
1 file changed
+8 -4
Download Patch File Download Diff File Expand all files Collapse all files
framework/framework/server.ts
+8 -4
View File
@@ -365,14 +365,18 @@ export class WebService<C extends CordisContext = CordisContext> extends Service
const corsAllowHeaders = 'x-requested-with, accept, origin, content-type, upgrade-insecure-requests'; const corsAllowHeaders = 'x-requested-with, accept, origin, content-type, upgrade-insecure-requests';
this.server.use(Compress()); this.server.use(Compress());
this.server.use(async (c, next) => { this.server.use(async (c, next) => {
if (c.request.headers.origin && this.config.cors) { if ((c.request.headers.origin || c.request.headers.referer) && this.config.cors) {
try { try {
const host = new URL(c.request.headers.origin).host; const host = new URL(c.request.headers.origin || c.request.headers.referer).host;
if (host !== c.request.headers.host && `,${this.config.cors},`.includes(`,${host},`)) { if (host !== c.request.headers.host && `,${this.config.cors},`.includes(`,${host},`)) {
c.set('Access-Control-Allow-Credentials', 'true'); c.set('Access-Control-Allow-Credentials', 'true');
c.set('Access-Control-Allow-Origin', c.request.headers.origin);
c.set('Access-Control-Allow-Headers', corsAllowHeaders); c.set('Access-Control-Allow-Headers', corsAllowHeaders);
c.set('Vary', 'Origin'); if (c.request.headers.origin) {
c.set('Access-Control-Allow-Origin', c.request.headers.origin);
c.set('Vary', 'Origin');
} else {
c.set('Vary', 'Referer');
}
c.cors = true; c.cors = true;
} }
} catch (e) { } catch (e) {