fastify / fastify/fastify-cors

Support Private Network CORS

Open
#277 8 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
JavaScript
Stars
497
Forks
69
PR merge metrics
No merged PRs in 30d

Description

### Prerequisites

- [X] I have written a descriptive issue title
- [X] I have searched existing issues to ensure the feature has not already been requested

### 🚀 Feature Proposal

There are changes coming to how we access private networks (localhost for example) from non localhost https websites. https://developer.chrome.com/blog/private-network-access-update/#cors-preflight-requests explains about all the changes plus the changes to CORS.

Basically needing to add `[Access-Control-Request-Private-Network](https://wicg.github.io/private-network-access/#http-headerdef-access-control-request-private-network): true` to the headers.

I've attached an example of what I've added as a patch to `@fastify/cors` which will need some extra work if these changes are accepted... like only setting the response if the `Access-Control-Request-Private-Network: true` header is in the request.

But before I did the extra work I wanted to see if this was useful/interesting.

### Motivation

_No response_

### Example

```
diff --git a/node_modules/@fastify/cors/index.js b/node_modules/@fastify/cors/index.js
index 28dfc9a..912853c 100644
--- a/node_modules/@fastify/cors/index.js
+++ b/node_modules/@fastify/cors/index.js
@@ -215,6 +215,10 @@ function addCorsHeaders (req, reply, originOption, corsOptions) {
reply.header('Access-Control-Allow-Credentials', 'true')
}

+ if (corsOptions.allowPrivateNetwork) {
+ reply.header('Access-Control-Allow-Private-Network', 'true')
+ }
+
if (corsOptions.exposedHeaders !== null) {
reply.header(
'Access-Control-Expose-Headers',
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.