aboutsummaryrefslogtreecommitdiffstats
path: root/plugins/mod_http.lua
diff options
context:
space:
mode:
authorKim Alvefur <zash@zash.se>2019-07-08 02:44:32 +0200
committerKim Alvefur <zash@zash.se>2019-07-08 02:44:32 +0200
commitf2b49140d8f9309bb3613effbef0739216ba7a9b (patch)
tree6b13265c066c8c32f4ed5d44fc9ca8421d118d06 /plugins/mod_http.lua
parente081fd664251a2eb7ab68262c2b8a3cad4b381c7 (diff)
parentae48864f9d7368bf2030d391d68d6363278202ea (diff)
downloadprosody-f2b49140d8f9309bb3613effbef0739216ba7a9b.tar.gz
prosody-f2b49140d8f9309bb3613effbef0739216ba7a9b.zip
Merge 0.11->trunk
Diffstat (limited to 'plugins/mod_http.lua')
-rw-r--r--plugins/mod_http.lua36
1 files changed, 33 insertions, 3 deletions
diff --git a/plugins/mod_http.lua b/plugins/mod_http.lua
index a1d409bd..17ea27e1 100644
--- a/plugins/mod_http.lua
+++ b/plugins/mod_http.lua
@@ -14,6 +14,7 @@ local moduleapi = require "core.moduleapi";
local url_parse = require "socket.url".parse;
local url_build = require "socket.url".build;
local normalize_path = require "util.http".normalize_path;
+local set = require "util.set";
local server = require "net.http.server";
@@ -22,6 +23,11 @@ server.set_default_host(module:get_option_string("http_default_host"));
server.set_option("body_size_limit", module:get_option_number("http_max_content_size"));
server.set_option("buffer_size_limit", module:get_option_number("http_max_buffer_size"));
+-- CORS settigs
+local opt_methods = module:get_option_set("access_control_allow_methods", { "GET", "OPTIONS" });
+local opt_headers = module:get_option_set("access_control_allow_headers", { "Content-Type" });
+local opt_max_age = module:get_option_number("access_control_max_age", 2 * 60 * 60);
+
local function get_http_event(host, app_path, key)
local method, path = key:match("^(%S+)%s+(.+)$");
if not method then -- No path specified, default to "" (base path)
@@ -83,6 +89,13 @@ function moduleapi.http_url(module, app_name, default_path)
return "http://disabled.invalid/";
end
+local function apply_cors_headers(response, methods, headers, max_age, origin)
+ response.headers.access_control_allow_methods = tostring(methods);
+ response.headers.access_control_allow_headers = tostring(headers);
+ response.headers.access_control_max_age = tostring(max_age)
+ response.headers.access_control_allow_origin = origin or "*";
+end
+
function module.add_host(module)
local host = module.host;
if host ~= "*" then
@@ -101,9 +114,27 @@ function module.add_host(module)
end
apps[app_name] = apps[app_name] or {};
local app_handlers = apps[app_name];
+
+ local app_methods = opt_methods;
+
+ local function cors_handler(event_data)
+ local request, response = event_data.request, event_data.response;
+ apply_cors_headers(response, app_methods, opt_headers, opt_max_age, request.headers.origin);
+ end
+
+ local function options_handler(event_data)
+ cors_handler(event_data);
+ return "";
+ end
+
for key, handler in pairs(event.item.route or {}) do
local event_name = get_http_event(host, app_path, key);
if event_name then
+ local method = event_name:match("^%S+");
+ if not app_methods:contains(method) then
+ app_methods = app_methods + set.new{ method };
+ end
+ local options_event_name = event_name:gsub("^%S+", "OPTIONS");
if type(handler) ~= "function" then
local data = handler;
handler = function () return data; end
@@ -121,6 +152,8 @@ function module.add_host(module)
if not app_handlers[event_name] then
app_handlers[event_name] = handler;
module:hook_object_event(server, event_name, handler);
+ module:hook_object_event(server, event_name, cors_handler, 1);
+ module:hook_object_event(server, options_event_name, options_handler, -1);
else
module:log("warn", "App %s added handler twice for '%s', ignoring", app_name, event_name);
end
@@ -195,9 +228,6 @@ module:provides("net", {
listener = server.listener;
default_port = 5281;
encryption = "ssl";
- ssl_config = {
- verify = "none";
- };
multiplex = {
pattern = "^[A-Z]";
};