Skip to content

Commit 3b5483b

Browse files
kanedevkanedev
committed
CORS
1 parent 16ea721 commit 3b5483b

File tree

7 files changed

+75
-41
lines changed

7 files changed

+75
-41
lines changed

‎Server-side Development with NodeJS, Express and MongoDB/conFusionServer/package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
},
88
"dependencies": {
99
"cookie-parser": "^1.4.3",
10+
"cors": "^2.8.4",
1011
"debug": "~2.6.9",
1112
"express": "~4.16.1",
1213
"express-session": "^1.15.6",

‎Server-side Development with NodeJS, Express and MongoDB/conFusionServer/routes/cors.js

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
const express = require('express');
2+
const cors = require('cors');
3+
const app = express();
4+
5+
const whitelist = ['http://localhost:3000', 'https://localhost:3443'];
6+
var corsOptionsDelegate = (req, callback) => {
7+
var corsOptions;
8+
console.log(req.header('Origin'));
9+
if(whitelist.indexOf(req.header('Origin')) !== -1) {
10+
corsOptions = { origin: true };
11+
}
12+
else {
13+
corsOptions = { origin: false };
14+
}
15+
callback(null, corsOptions);
16+
};
17+
18+
exports.cors = cors();
19+
exports.corsWithOptions = cors(corsOptionsDelegate);

‎Server-side Development with NodeJS, Express and MongoDB/conFusionServer/routes/dishRouter.js

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,15 @@ const Dishes = require('../models/dishes');
66

77
const dishRouter = express.Router();
88
const user = require('../models/user');
9+
const cors = require('./cors');
910

1011
dishRouter.use(bodyParser.json());
1112

1213
// Dishes
1314

1415
dishRouter.route('/')
15-
.get((req,res,next) => {
16+
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
17+
.get(cors.cors, (req, res, next) => {
1618
Dishes.find({})
1719
.populate('comments.author')
1820
.then((dishes) => {
@@ -22,7 +24,7 @@ dishRouter.route('/')
2224
}, (err) => next(err))
2325
.catch((err) => next(err));
2426
})
25-
.post(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
27+
.post(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
2628
Dishes.create(req.body)
2729
.then((dish) => {
2830
console.log('Dish Created ', dish);
@@ -32,11 +34,11 @@ dishRouter.route('/')
3234
}, (err) => next(err))
3335
.catch((err) => next(err));
3436
})
35-
.put(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
37+
.put(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
3638
res.statusCode = 403;
3739
res.end('PUT operation not supported on /dishes');
3840
})
39-
.delete(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
41+
.delete(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
4042
Dishes.remove({})
4143
.then((resp) => {
4244
res.statusCode = 200;
@@ -49,7 +51,8 @@ dishRouter.route('/')
4951
//Dish id
5052

5153
dishRouter.route('/:dishId')
52-
.get((req,res,next) => {
54+
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
55+
.get(cors.cors, (req, res, next) => {
5356
Dishes.findById(req.params.dishId)
5457
.populate('comments.author')
5558
.then((dish) => {
@@ -59,11 +62,11 @@ dishRouter.route('/:dishId')
5962
}, (err) => next(err))
6063
.catch((err) => next(err));
6164
})
62-
.post(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
65+
.post(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
6366
res.statusCode = 403;
6467
res.end('POST operation not supported on /dishes/'+ req.params.dishId);
6568
})
66-
.put(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
69+
.put(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
6770
Dishes.findByIdAndUpdate(req.params.dishId, {
6871
$set: req.body
6972
}, { new: true })
@@ -74,7 +77,7 @@ dishRouter.route('/:dishId')
7477
}, (err) => next(err))
7578
.catch((err) => next(err));
7679
})
77-
.delete(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
80+
.delete(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
7881
Dishes.findByIdAndRemove(req.params.dishId)
7982
.then((resp) => {
8083
res.statusCode = 200;
@@ -87,7 +90,8 @@ dishRouter.route('/:dishId')
8790
// Dish's comments
8891

8992
dishRouter.route('/:dishId/comments')
90-
.get((req,res,next) => {
93+
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
94+
.get(cors.cors, (req, res, next) => {
9195
Dishes.findById(req.params.dishId)
9296
.populate('comments.author')
9397
.then((dish) => {
@@ -104,7 +108,7 @@ dishRouter.route('/:dishId/comments')
104108
}, (err) => next(err))
105109
.catch((err) => next(err));
106110
})
107-
.post(authenticate.verifyUser, (req, res, next) => {
111+
.post(cors.corsWithOptions,authenticate.verifyUser, (req, res, next) => {
108112
Dishes.findById(req.params.dishId)
109113
.then((dish) => {
110114
if (dish != null) {
@@ -129,12 +133,12 @@ dishRouter.route('/:dishId/comments')
129133
}, (err) => next(err))
130134
.catch((err) => next(err));
131135
})
132-
.put(authenticate.verifyUser, (req, res, next) => {
136+
.put(cors.corsWithOptions,authenticate.verifyUser, (req, res, next) => {
133137
res.statusCode = 403;
134138
res.end('PUT operation not supported on /dishes/'
135139
+ req.params.dishId + '/comments');
136140
})
137-
.delete(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
141+
.delete(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
138142
Dishes.findById(req.params.dishId)
139143
.then((dish) => {
140144
if (dish != null) {
@@ -160,7 +164,8 @@ dishRouter.route('/:dishId/comments')
160164
// Dishes's one comment
161165

162166
dishRouter.route('/:dishId/comments/:commentId')
163-
.get((req,res,next) => {
167+
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
168+
.get(cors.cors, (req, res, next) => {
164169
Dishes.findById(req.params.dishId)
165170
.populate('comments.author')
166171
.then((dish) => {
@@ -182,12 +187,12 @@ dishRouter.route('/:dishId/comments/:commentId')
182187
}, (err) => next(err))
183188
.catch((err) => next(err));
184189
})
185-
.post(authenticate.verifyUser, (req, res, next) => {
190+
.post(cors.corsWithOptions,authenticate.verifyUser, (req, res, next) => {
186191
res.statusCode = 403;
187192
res.end('POST operation not supported on /dishes/'+ req.params.dishId
188193
+ '/comments/' + req.params.commentId);
189194
})
190-
.put(authenticate.verifyUser, (req, res, next) => {
195+
.put(cors.corsWithOptions,authenticate.verifyUser, (req, res, next) => {
191196
Dishes.findById(req.params.dishId)
192197
.then((dish) => {
193198
if (dish != null && dish.comments.id(req.params.commentId) != null) {
@@ -228,7 +233,7 @@ dishRouter.route('/:dishId/comments/:commentId')
228233
}, (err) => next(err))
229234
.catch((err) => next(err));
230235
})
231-
.delete(authenticate.verifyUser, (req, res, next) => {
236+
.delete(cors.corsWithOptions,authenticate.verifyUser, (req, res, next) => {
232237
Dishes.findById(req.params.dishId)
233238
.then((dish) => {
234239
if (dish != null && dish.comments.id(req.params.commentId) != null) {

‎Server-side Development with NodeJS, Express and MongoDB/conFusionServer/routes/leaderRouter.js

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,15 @@ const bodyParser = require('body-parser');
33
var authenticate = require('../authenticate');
44

55
const Leaders = require('../models/Leaders');
6+
const cors = require('./cors');
67

78
const leaderRouter = express.Router();
89

910
leaderRouter.use(bodyParser.json());
1011

1112
leaderRouter.route('/')
12-
.get((req,res,next) => {
13+
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
14+
.get(cors.cors, (req, res, next) => {
1315
Leaders.find({})
1416
.then((Leaders) => {
1517
res.statusCode = 200;
@@ -18,7 +20,7 @@ leaderRouter.route('/')
1820
}, (err) => next(err))
1921
.catch((err) => next(err));
2022
})
21-
.post(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
23+
.post(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
2224
Leaders.create(req.body)
2325
.then((leader) => {
2426
console.log('leader Created ', leader);
@@ -28,11 +30,11 @@ leaderRouter.route('/')
2830
}, (err) => next(err))
2931
.catch((err) => next(err));
3032
})
31-
.put(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
33+
.put(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
3234
res.statusCode = 403;
3335
res.end('PUT operation not supported on /Leaders');
3436
})
35-
.delete(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
37+
.delete(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
3638
Leaders.remove({})
3739
.then((resp) => {
3840
res.statusCode = 200;
@@ -43,7 +45,8 @@ leaderRouter.route('/')
4345
});
4446

4547
leaderRouter.route('/:leaderId')
46-
.get((req,res,next) => {
48+
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
49+
.get(cors.cors, (req, res, next) => {
4750
Leaders.findById(req.params.leaderId)
4851
.then((leader) => {
4952
res.statusCode = 200;
@@ -52,11 +55,11 @@ leaderRouter.route('/:leaderId')
5255
}, (err) => next(err))
5356
.catch((err) => next(err));
5457
})
55-
.post(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
58+
.post(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
5659
res.statusCode = 403;
5760
res.end('POST operation not supported on /Leaders/'+ req.params.leaderId);
5861
})
59-
.put(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
62+
.put(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
6063
Leaders.findByIdAndUpdate(req.params.leaderId, {
6164
$set: req.body
6265
}, { new: true })
@@ -67,7 +70,7 @@ leaderRouter.route('/:leaderId')
6770
}, (err) => next(err))
6871
.catch((err) => next(err));
6972
})
70-
.delete(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
73+
.delete(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
7174
Leaders.findByIdAndRemove(req.params.leaderId)
7275
.then((resp) => {
7376
res.statusCode = 200;

‎Server-side Development with NodeJS, Express and MongoDB/conFusionServer/routes/promoRouter.js

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,13 @@ var authenticate = require('../authenticate');
55
const Promos = require('../models/Promos');
66

77
const promoRouter = express.Router();
8+
const cors = require('./cors');
89

910
promoRouter.use(bodyParser.json());
1011

1112
promoRouter.route('/')
12-
.get((req,res,next) => {
13+
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
14+
.get(cors.cors, (req, res, next) => {
1315
Promos.find({})
1416
.then((Promos) => {
1517
res.statusCode = 200;
@@ -18,7 +20,7 @@ promoRouter.route('/')
1820
}, (err) => next(err))
1921
.catch((err) => next(err));
2022
})
21-
.post(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
23+
.post(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
2224
Promos.create(req.body)
2325
.then((promo) => {
2426
console.log('promo Created ', promo);
@@ -28,11 +30,11 @@ promoRouter.route('/')
2830
}, (err) => next(err))
2931
.catch((err) => next(err));
3032
})
31-
.put(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
33+
.put(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
3234
res.statusCode = 403;
3335
res.end('PUT operation not supported on /Promos');
3436
})
35-
.delete(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
37+
.delete(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
3638
Promos.remove({})
3739
.then((resp) => {
3840
res.statusCode = 200;
@@ -43,7 +45,8 @@ promoRouter.route('/')
4345
});
4446

4547
promoRouter.route('/:promoId')
46-
.get((req,res,next) => {
48+
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
49+
.get(cors.cors, (req, res, next) => {
4750
Promos.findById(req.params.promoId)
4851
.then((promo) => {
4952
res.statusCode = 200;
@@ -52,11 +55,11 @@ promoRouter.route('/:promoId')
5255
}, (err) => next(err))
5356
.catch((err) => next(err));
5457
})
55-
.post(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
58+
.post(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
5659
res.statusCode = 403;
5760
res.end('POST operation not supported on /Promos/'+ req.params.promoId);
5861
})
59-
.put(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
62+
.put(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
6063
Promos.findByIdAndUpdate(req.params.promoId, {
6164
$set: req.body
6265
}, { new: true })
@@ -67,7 +70,7 @@ promoRouter.route('/:promoId')
6770
}, (err) => next(err))
6871
.catch((err) => next(err));
6972
})
70-
.delete(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
73+
.delete(cors.corsWithOptions,authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
7174
Promos.findByIdAndRemove(req.params.promoId)
7275
.then((resp) => {
7376
res.statusCode = 200;

‎Server-side Development with NodeJS, Express and MongoDB/conFusionServer/routes/uploadRouter.js

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ const express = require('express');
22
const bodyParser = require('body-parser');
33
const authenticate = require('../authenticate');
44
const multer = require('multer');
5+
const cors = require('./cors');
56

67
const storage = multer.diskStorage({
78
destination: (req, file, cb) => {
@@ -27,20 +28,21 @@ const uploadRouter = express.Router();
2728
uploadRouter.use(bodyParser.json());
2829

2930
uploadRouter.route('/')
30-
.get(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
31+
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
32+
.get(cors.cors, authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
3133
res.statusCode = 403;
3234
res.end('GET operation not supported on /imageUpload');
3335
})
34-
.post(authenticate.verifyUser, authenticate.verifyAdmin, upload.single('imageFile'), (req, res) => {
36+
.post(cors.corsWithOptions, authenticate.verifyUser, authenticate.verifyAdmin, upload.single('imageFile'), (req, res) => {
3537
res.statusCode = 200;
3638
res.setHeader('Content-Type', 'application/json');
3739
res.json(req.file);
3840
})
39-
.put(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
41+
.put(cors.corsWithOptions, authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
4042
res.statusCode = 403;
4143
res.end('PUT operation not supported on /imageUpload');
4244
})
43-
.delete(authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
45+
.delete(cors.corsWithOptions, authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next) => {
4446
res.statusCode = 403;
4547
res.end('DELETE operation not supported on /imageUpload');
4648
});

‎Server-side Development with NodeJS, Express and MongoDB/conFusionServer/routes/users.js

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,14 @@ const bodyParser = require('body-parser');
33
const User = require('../models/user');
44
const passport = require('passport');
55
const authenticate = require('../authenticate');
6-
6+
const cors = require('./cors');
77

88
const usersRouter = express.Router();
99
usersRouter.use(bodyParser.json());
1010

1111
usersRouter.route('/')
12-
.get( authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next)=> {
12+
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
13+
.get(cors.corsWithOptions, authenticate.verifyUser, authenticate.verifyAdmin, (req, res, next)=> {
1314
User.find({})
1415
.then((users) =>{
1516
res.statusCode = 200;
@@ -20,7 +21,7 @@ usersRouter.route('/')
2021
})
2122
// USERS/SIGN UP
2223

23-
usersRouter.post('/signup', (req, res, next) => {
24+
usersRouter.post('/signup', cors.corsWithOptions, (req, res, next) => {
2425
User.register(new User({ username: req.body.username }),
2526
req.body.password, (err, user) => {
2627
if (err) {
@@ -53,15 +54,15 @@ usersRouter.post('/signup', (req, res, next) => {
5354

5455
// USERS/LOGIN
5556

56-
usersRouter.post('/login', passport.authenticate('local'), (req, res) => {
57+
usersRouter.post('/login', cors.corsWithOptions, passport.authenticate('local'), (req, res) => {
5758

5859
var token = authenticate.getToken({ _id: req.user._id });//going to create a token by giving a payload, which only contains the ID of the user. So, we'll say id: req.user._id. That is sufficient enough for creating the JsonWebToken. We don't want to include any other of the user's information
5960
res.statusCode = 200;
6061
res.setHeader('Content-Type', 'application/json');
6162
res.json({ success: true, token: token, status: 'You are successfully logged in!' });
6263
});
6364

64-
usersRouter.get('/logout', (req, res,next) => {
65+
usersRouter.get('/logout',cors.corsWithOptions, (req, res,next) => {
6566
if (req.session) {
6667
req.session.destroy();
6768
res.clearCookie('session-id');

0 commit comments

Comments
 (0)