fastify / fastify/fastify-cors
Support Private Network CORS
- Dominant language
- JavaScript
- Stars
- 497
- Forks
- 69
- PR merge metrics
- No merged PRs in 30d
Description
### Prerequisites
- [X] I have written a descriptive issue title
- [X] I have searched existing issues to ensure the feature has not already been requested
### 🚀 Feature Proposal
There are changes coming to how we access private networks (localhost for example) from non localhost https websites. https://developer.chrome.com/blog/private-network-access-update/#cors-preflight-requests explains about all the changes plus the changes to CORS.
Basically needing to add `[Access-Control-Request-Private-Network](https://wicg.github.io/private-network-access/#http-headerdef-access-control-request-private-network): true` to the headers.
I've attached an example of what I've added as a patch to `@fastify/cors` which will need some extra work if these changes are accepted... like only setting the response if the `Access-Control-Request-Private-Network: true` header is in the request.
But before I did the extra work I wanted to see if this was useful/interesting.
### Motivation
_No response_
### Example
```
diff --git a/node_modules/@fastify/cors/index.js b/node_modules/@fastify/cors/index.js
index 28dfc9a..912853c 100644
--- a/node_modules/@fastify/cors/index.js
+++ b/node_modules/@fastify/cors/index.js
@@ -215,6 +215,10 @@ function addCorsHeaders (req, reply, originOption, corsOptions) {
reply.header('Access-Control-Allow-Credentials', 'true')
}
+ if (corsOptions.allowPrivateNetwork) {
+ reply.header('Access-Control-Allow-Private-Network', 'true')
+ }
+
if (corsOptions.exposedHeaders !== null) {
reply.header(
'Access-Control-Expose-Headers',
```
Contributor guide
Assessment
This issue has not been assessed yet.