Merge pull request #65 from ash0ne/master

Implementing configurable CORS settings

Author: mendhak

README.md

@@ -30,6 +30,7 @@ This image is executed as non root by default and is fully compliant with Kubern
 - [Add a delay before response](#add-a-delay-before-response)
 - [Only return body in the response](#only-return-body-in-the-response)
 - [Include environment variables in the response](#include-environment-variables-in-the-response)
+- [Configuring CORS policy](#setting-corscross-origin-resource-sharing-headers-in-the-response) 
 - [Client certificate details (mTLS) in the response](#client-certificate-details-mtls-in-the-response)
 - [Prometheus Metrics](#prometheus-metrics)
 - [Screenshots](#screenshots)
@@ -247,6 +248,17 @@ docker run -d --rm -e ECHO_INCLUDE_ENV_VARS=1 --name http-echo-tests -p 8080:808
 
 Then do a normal request via curl or browser, and you will see the `env` property in the response body.
 
+## Setting CORS(Cross-Origin Resource Sharing) headers in the response
+
+Enable CORS headers in response by setting the environment variable `CORS_ALLOW_ORIGIN` to the list of allowed origins.
+CORS configuration can be further fine-tuned by using the following environment variables:
+
+- **`CORS_ALLOW_METHODS`**: List of Http methods allowed.
+- **`CORS_ALLOW_HEADERS`**: List of headers allowed.
+- **`CORS_ALLOW_CREDENTIALS`**: Comma-separated list of origin URLs from which the policy allows credentials to be sent.
+
+None of these CORS settings can be set without setting the `CORS_ALLOW_ORIGIN` first. By default, they will all be missing when only the `CORS_ALLOW_ORIGIN` is set and need to be explicitly specified alongside `CORS_ALLOW_ORIGIN`.
+
 
 ## Client certificate details (mTLS) in the response
 

index.js

@@ -114,6 +114,20 @@ app.all('*', (req, res) => {
       res.contentType(setResponseContentType);
     }
 
+    //Set the CORS policy
+    if (process.env.CORS_ALLOW_ORIGIN){
+      res.header('Access-Control-Allow-Origin', process.env.CORS_ALLOW_ORIGIN);
+      if (process.env.CORS_ALLOW_METHODS) {
+        res.header('Access-Control-Allow-Methods', process.env.CORS_ALLOW_METHODS);
+      }
+      if (process.env.CORS_ALLOW_HEADERS) {
+        res.header('Access-Control-Allow-Headers', process.env.CORS_ALLOW_HEADERS);
+      }
+      if (process.env.CORS_ALLOW_CREDENTIALS) {
+        res.header('Access-Control-Allow-Credentials', process.env.CORS_ALLOW_CREDENTIALS);
+      }
+    }
+
     //Ability to send an empty response back
     if (process.env.ECHO_BACK_TO_CLIENT != undefined && process.env.ECHO_BACK_TO_CLIENT == "false"){
       res.end();

tests.sh

@@ -271,6 +271,26 @@ else
     exit 1
 fi
 
+message " Stop containers "
+docker stop http-echo-tests
+sleep 5
+
+message " Start container with CORS_CONFIG"
+docker run -d --rm \
+    -e CORS_ALLOW_ORIGIN="http://example.com" -e CORS_ALLOW_HEADERS="x-custom-test-header" \
+    --name http-echo-tests -p 8080:8080 -p 8443:8443 -t mendhak/http-https-echo
+sleep 5
+# Check if the expected CORS headers are present in the response
+if curl -s -i http://localhost:8080/ 2>&1 | grep -q -E \
+    "Access-Control-Allow-Headers: x-custom-test-header" &&
+    curl -s -i http://localhost:8080/ 2>&1 | grep -q -E \
+    "Access-Control-Allow-Origin: http://example.com"; then
+    passed "CORS_CONFIG expected CORS headers found in response"
+else
+    failed "CORS_CONFIG failed."
+    docker logs http-echo-tests
+    exit 1
+fi
 
 message " Stop containers "
 docker stop http-echo-tests