Flea Flicker
dace2c4e66
fix(GRO-2586): enforce trusted-origins allowlist on Better Auth CORS responses Co-Authored-By: Paperclip <noreply@paperclip.ing>
23 lines
951 B
TypeScript
23 lines
951 B
TypeScript
/**
|
|
* Enforces the trusted-origins CORS allowlist on a raw Response from Better Auth.
|
|
* Better Auth reflects the request Origin into Access-Control-Allow-Origin
|
|
* regardless of the trustedOrigins config, allowing credentialed cross-origin reads
|
|
* from arbitrary attacker origins. This wrapper strips CORS headers for any origin
|
|
* not in the allowlist. (GRO-2586)
|
|
*/
|
|
export function enforceAuthCors(
|
|
requestOrigin: string | undefined,
|
|
trustedOrigins: string[],
|
|
res: Response
|
|
): Response {
|
|
const headers = new Headers(res.headers);
|
|
if (requestOrigin && trustedOrigins.includes(requestOrigin)) {
|
|
headers.set("Access-Control-Allow-Origin", requestOrigin);
|
|
headers.set("Access-Control-Allow-Credentials", "true");
|
|
} else {
|
|
headers.delete("Access-Control-Allow-Origin");
|
|
headers.delete("Access-Control-Allow-Credentials");
|
|
}
|
|
return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
|
|
}
|