Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix return value for origin when none matched #16

Merged
merged 1 commit into from
Mar 11, 2016
Merged

Fix return value for origin when none matched #16

merged 1 commit into from
Mar 11, 2016

Conversation

hauntedhost
Copy link
Contributor

This fixes [error] Bad value on output port 'tcp_inet' when request origin is not in allowed origins, by returning "null" string, instead of nil, which I believe is not a valid value for this header. See: https://www.w3.org/TR/cors/#access-control-allow-origin-response-header

Not entirely sure of the implications. Thoughts?

end

def call(conn, options) do
conn = put_in conn.resp_headers, conn.resp_headers ++ headers(conn, options)
new_headers = headers(conn, options)
conn = put_in(conn.resp_headers, new_headers)
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will override previously set headers

@mschae
Copy link
Owner

mschae commented Mar 11, 2016

I haven't gotten around to this, thanks for taking care of it!

I added a few notes, if you could fix those and squash it all into one commit, please.

Thanks again!

@mschae mschae changed the title Acao null string if invalid Fix return value for origin when none matched Mar 11, 2016
@hauntedhost
Copy link
Contributor Author

@mschae awesome, glad to help. Lemme know if my last commit addresses everything, if so I'll squash and force push.

@mschae
Copy link
Owner

mschae commented Mar 11, 2016

Looks great, thanks so much @somlor!

@hauntedhost
Copy link
Contributor Author

One little thing, looks like mix test throws warnings on the @doc for private functions:

lib/cors_plug.ex:30: warning: function headers/2 is private, @doc's are always discarded for private functions
lib/cors_plug.ex:41: warning: function headers/2 is private, @doc's are always discarded for private functions
lib/cors_plug.ex:52: warning: function origin/2 is private, @doc's are always discarded for private functions
lib/cors_plug.ex:59: warning: function origin/2 is private, @doc's are always discarded for private functions
lib/cors_plug.ex:66: warning: function origin/2 is private, @doc's are always discarded for private functions
lib/cors_plug.ex:73: warning: function origin/2 is private, @doc's are always discarded for private functions

Thoughts?

@mschae
Copy link
Owner

mschae commented Mar 11, 2016

Hm, didn't know that, sorry... Since that warning will likely be emitted when compiling this as a dep, please silently curse me and revert back to code comments. Sorry about that.

@hauntedhost
Copy link
Contributor Author

lol, no worries at all. Will push up a single commit in a minute. 😸

problem:
access-control-allow-origin header returns invalid nil value when request is
not in whitelisted origin(s). this causes an erlang error:
"Bad value on output port 'tcp_inet'"

solution:
return "null" string recommended in w3c spec
https://www.w3.org/TR/cors/#access-control-allow-origin-response-header

other changes:
- replace deprecated Dict.merge with Keyword.merge
- use parens and pipes for added clarity
- add explanatory comments
mschae added a commit that referenced this pull request Mar 11, 2016
Fix return value for origin when none matched
@mschae mschae merged commit 9b76993 into mschae:master Mar 11, 2016
@mschae
Copy link
Owner

mschae commented Mar 11, 2016

Published v1.1.1 based on this, thanks @somlor!

@hauntedhost
Copy link
Contributor Author

Happy to help! Thanks for creating this. 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants