@speakr/speakr-module-services/middleware/cors/index.js

SPEAKR Shared Service Module

'use strict';

const env = require('../../env');
const ssl = require('express-ssl');
const cors = require('cors');
const helmet = require('helmet');
const csp = require('helmet-csp');
const crossdomain = require('helmet-crossdomain');

// const middleware = require('../authentication').strategies.cors();

module.exports = (app, whitelist) => {
  if (!app) throw new Error('Could not setup cors: no app provided. ');
  let domains = [].concat((whitelist || env.ACCESS_CONTROL_ALLOW_ORIGIN || '').split(/\s*[\s,]\s*/)).join(' ');
  // app.use(ssl());
  app.use(helmet());
  app.use(csp({
    directives: {
      defaultSrc: domains
    },
    setAllHeaders: true,
    // Set to true if you want to disable CSP on Android where it can be buggy.
    disableAndroid: false
  }));
  app.use(cors({
    origin: domains,
    methods: env.ACCESS_CONTROL_ALLOW_METHODS || 'GET,HEAD,PUT,POST,DELETE,PATCH',
    preflightContinue: true,
    allowedHeaders: env.ACCESS_CONTROL_ALLOW_HEADERS,
    exposedHeaders: env.ACCESS_CONTROL_EXPOSE_HEADERS || 'Content-Length,X-Auth-Token',
    maxAge: env.ACCESS_CONTROL_ALLOW_MAX_AGE
  }));

  app.options('*');
};