feat: support secure context headers

see https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer/Planned_changes

allow to use SharedArrayBuffer

modified by #82

Author: ltomes

README.md

@@ -55,6 +55,7 @@ app.use(cors());
  *  - {String|Number} maxAge `Access-Control-Max-Age` in seconds
  *  - {Boolean|Function(ctx)} credentials `Access-Control-Allow-Credentials`, default is false.
  *  - {Boolean} keepHeadersOnError Add set headers to `err.header` if an error is thrown
+ *  - {Boolean} secureContext `Cross-Origin-Opener-Policy` & `Cross-Origin-Embedder-Policy` headers.', default is false
  * @return {Function} cors middleware
  * @api public
  */

index.js

@@ -13,12 +13,15 @@ const vary = require('vary');
  *  - {String|Number} maxAge `Access-Control-Max-Age` in seconds
  *  - {Boolean} credentials `Access-Control-Allow-Credentials`
  *  - {Boolean} keepHeadersOnError Add set headers to `err.header` if an error is thrown
+ *  - {Boolean} secureContext `Cross-Origin-Opener-Policy` & `Cross-Origin-Embedder-Policy` headers.', default is false
+ *    @see https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer/Planned_changes
  * @return {Function} cors middleware
  * @api public
  */
 module.exports = function(options) {
   const defaults = {
     allowMethods: 'GET,HEAD,PUT,POST,DELETE,PATCH',
+    secureContext: false,
   };
 
   options = {
@@ -43,7 +46,7 @@ module.exports = function(options) {
   }
 
   options.keepHeadersOnError = options.keepHeadersOnError === undefined || !!options.keepHeadersOnError;
-
+  
   return async function cors(ctx, next) {
     // If the Origin header is not present terminate this set of steps.
     // The request is outside the scope of this specification.
@@ -91,6 +94,11 @@ module.exports = function(options) {
         set('Access-Control-Expose-Headers', options.exposeHeaders);
       }
 
+      if (options.secureContext) {
+        set('Cross-Origin-Opener-Policy', 'same-origin');
+        set('Cross-Origin-Embedder-Policy', 'require-corp');
+      }
+
       if (!options.keepHeadersOnError) {
         return await next();
       }
@@ -133,6 +141,11 @@ module.exports = function(options) {
         ctx.set('Access-Control-Allow-Methods', options.allowMethods);
       }
 
+      if (options.secureContext) {
+        set('Cross-Origin-Opener-Policy', 'same-origin');
+        set('Cross-Origin-Embedder-Policy', 'require-corp');
+      }
+
       let allowHeaders = options.allowHeaders;
       if (!allowHeaders) {
         allowHeaders = ctx.get('Access-Control-Request-Headers');

test/cors.test.js

@@ -79,6 +79,58 @@ describe('cors.test.js', function() {
     });
   });
 
+  describe('options.secureContext=true', function() {
+    const app = new Koa();
+    app.use(cors({
+      secureContext: true,
+    }));
+    app.use(function(ctx) {
+      ctx.body = { foo: 'bar' };
+    });
+
+    it('should always set `Cross-Origin-Opener-Policy` & `Cross-Origin-Embedder-Policy` on not OPTIONS', function(done) {
+      request(app.listen())
+        .get('/')
+        .set('Origin', 'http://koajs.com')
+        .expect('Cross-Origin-Opener-Policy', 'same-origin')
+        .expect('Cross-Origin-Embedder-Policy', 'require-corp')
+        .expect({ foo: 'bar' })
+        .expect(200, done);
+    });
+
+    it('should always set `Cross-Origin-Opener-Policy` & `Cross-Origin-Embedder-Policy` on OPTIONS', function(done) {
+      request(app.listen())
+        .options('/')
+        .set('Origin', 'http://koajs.com')
+        .set('Access-Control-Request-Method', 'PUT')
+        .expect('Cross-Origin-Opener-Policy', 'same-origin')
+        .expect('Cross-Origin-Embedder-Policy', 'require-corp')
+        .expect(204, done);
+    });
+  });
+
+  describe('options.secureContext=false', function() {
+    const app = new Koa();
+    app.use(cors({
+      secureContext: false,
+    }));
+    app.use(function(ctx) {
+      ctx.body = { foo: 'bar' };
+    });
+
+    it('should not set `Cross-Origin-Opener-Policy` & `Cross-Origin-Embedder-Policy`', function(done) {
+      request(app.listen())
+        .get('/')
+        .set('Origin', 'http://koajs.com')
+        .expect(res => {
+          assert(!('Cross-Origin-Opener-Policy' in res.headers));
+          assert(!('Cross-Origin-Embedder-Policy' in res.headers));
+        })
+        .expect({ foo: 'bar' })
+        .expect(200, done);
+    });
+  });
+
   describe('options.origin=function', function() {
     const app = new Koa();
     app.use(cors({