graphql-yoga
Version:
34 lines (33 loc) • 1.33 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.useAllowedResponseHeaders = useAllowedResponseHeaders;
exports.useAllowedRequestHeaders = useAllowedRequestHeaders;
function useAllowedResponseHeaders(allowedHeaders) {
const allowedHeaderNames = toLowerCaseSet(allowedHeaders);
return {
onResponse({ response }) {
removeDisallowedHeaders(response.headers, allowedHeaderNames);
},
};
}
function useAllowedRequestHeaders(allowedHeaders) {
const allowedHeaderNames = toLowerCaseSet(allowedHeaders);
return {
onRequest({ request }) {
removeDisallowedHeaders(request.headers, allowedHeaderNames);
},
};
}
function toLowerCaseSet(allowedHeaders) {
return new Set(allowedHeaders.map(name => name.toLowerCase()));
}
function removeDisallowedHeaders(headers, allowedHeaderNames) {
// Header names are case-insensitive (e.g. built-in result processors send `Content-Type`),
// so the allow-list must be compared case-insensitively too, or else legitimately allowed
// headers get stripped whenever their casing doesn't match the list verbatim.
for (const headerName of headers.keys()) {
if (!allowedHeaderNames.has(headerName.toLowerCase())) {
headers.delete(headerName);
}
}
}