search

gr2m / hapi-cors-headers

hapi extension to enable CORS
MIT License
28 stars 11 forks source link

Huh? #24

Open hueniverse opened 5 years ago

hueniverse commented 5 years ago

Can someone explain the purpose of this module? I'm confused.

gr2m commented 5 years ago

Hi Eran 👋

It’s been a while since I used it myself. Back when we created it to use it with Hoodie, we needed a CORS API which works universally for all origins and accepts authentication (Access-Control-Allow-Credentials: true). If I recall correctly, just setting Access-Control-Allow-Origin: * is not allowed in combination with Access-Control-Allow-Credentials: true, so we set it dynamically to the request origin (see /index.js#L12).

I’ve never updated the module to the latest Hapi though since I stopped using it myself.

Does Hapi support this behavior out of the box now?

hueniverse commented 5 years ago

So this basically enables CORS while also disabling all of its protections?

gr2m commented 5 years ago

Yes, you should not use it if your server uses cookies for authentication. I should probably put a big warning in the README 🤔