From 1cf9e271ccea793906f6848339f197a55132a174 Mon Sep 17 00:00:00 2001 From: Rory& Date: Wed, 28 May 2025 09:17:55 +0200 Subject: Move middlewares out of start.js --- src/api/middlewares/corsMiddleware.js | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 src/api/middlewares/corsMiddleware.js (limited to 'src/api/middlewares/corsMiddleware.js') diff --git a/src/api/middlewares/corsMiddleware.js b/src/api/middlewares/corsMiddleware.js new file mode 100644 index 0000000..2d06d47 --- /dev/null +++ b/src/api/middlewares/corsMiddleware.js @@ -0,0 +1,25 @@ +export function useCors(req, res, next) { + res.set( + "Content-security-policy", + "default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: ; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';", + ); + + res.set("Access-Control-Allow-Origin", "*"); + res.set( + "Access-Control-Allow-Headers", + req.header("Access-Control-Request-Headers") || "*", + ); + res.set( + "Access-Control-Allow-Methods", + req.header("Access-Control-Request-Methods") || "*", + ); + + res.set("Access-Control-Allow-Credentials", "true"); + + // Handle preflight requests + if (req.method === "OPTIONS") { + return res.sendStatus(204); + } + + next(); +} -- cgit 1.5.1