wai-cors 0.1.1 → 0.1.2
raw patch · 8 files changed
+259/−56 lines, 8 files
Files
- CHANGELOG.md +15/−0
- Confirmed-Constraints +0/−51
- README.md +42/−0
- constraints +55/−0
- src/Network/Wai/Middleware/Cors.hs +59/−3
- test/index.html +65/−0
- test/server.hs +19/−0
- wai-cors.cabal +4/−2
CHANGELOG.md view
@@ -1,3 +1,18 @@+0.1.2+=====++* Export type synonym `Origin`++* New easy-to-use middleware function `simpleCors` that supports just+ simple cross-origin requests++* The new value `simpleCorseResourcePolicy` is a `CorseResourcePolicy`+ for simple cross-origin requests.++* Documentation has been slightly improved++* Some code for testing `simpleCors` from a browser+ 0.1.1 =====
− Confirmed-Constraints
@@ -1,51 +0,0 @@-constraints: MonadRandom == 0.1.12- , array == 0.4.0.1- , attoparsec == 0.11.2.1- , base == 4.6.0.1- , base-unicode-symbols == 0.2.2.4- , blaze-builder == 0.3.3.2- , bytestring == 0.10.4.0- , case-insensitive == 1.1.0.3- , charset == 0.3.7- , comonad == 4.0- , conduit == 1.0.15.1- , containers == 0.5.0.0- , contravariant == 0.4.4- , deepseq == 1.3.0.1- , directory == 1.2.0.1- , distributive == 0.4- , either == 4.1.1- , errors == 1.4.5- , filepath == 1.3.0.1- , ghc-prim == 0.3.0.0- , hashable == 1.2.1.0- , http-types == 0.8.3- , integer-gmp == 0.5.0.0- , lifted-base == 0.2.1.1- , mmorph == 1.0.2- , monad-control == 0.3.2.2- , mtl == 2.1.2- , nats == 0.1.2- , network == 2.4.2.2- , old-locale == 1.0.0.5- , parsec == 3.1.5- , parsers == 0.11- , random == 1.0.1.1- , resourcet == 0.4.10- , rts == 1.0- , safe == 0.3.3- , scientific == 0.2.0.2- , semigroupoids == 4.0- , semigroups == 0.12.2- , tagged == 0.7- , text == 1.1.0.1- , text-stream-decode == 0.1.0.4- , time == 1.4.0.1- , transformers == 0.3.0.0- , transformers-base == 0.4.1- , transformers-compat == 0.1.1.1- , unix == 2.7.0.0- , unordered-containers == 0.2.3.3- , vault == 0.3.0.3- , void == 0.6.1- , wai == 1.4.1
README.md view
@@ -6,3 +6,45 @@ that aims to be compliant with [http://www.w3.org/TR/cors](http://www.w3.org/TR/cors). +Usage+-----++The file `test/server.hs` shows how to support simple cross-origin requests (as+defined in [http://www.w3.org/TR/cors](http://www.w3.org/TR/cors)) in a+[scotty](http://hackage.haskell.org/package/scotty) application.++~~~{.haskell}+{-# LANGUAGE UnicodeSyntax #-}+{-# LANGUAGE OverloadedStrings #-}++module Main+( main+) where++import Network.Wai.Middleware.Cors+import Web.Scotty++main ∷ IO ()+main = scotty 8080 $ do+ middleware simpleCors+ matchAny "/" $ text "Success"+~~~++Documentation for more general usage can be found in the module+[Network.Wai.Middleware.Cors](http://hackage.haskell.org/package/wai-cors/docs/Network-Wai-Middleware-Cors.html).++TEST+----++Currently there is only basic support to test simple cross-origin+request from a browser.++Start server:++~~~{.bash}+cd test+runHaskell server.hs+~~~++Open the file `test/index.html` in a modern web-browser in order to run some+simple tests.
+ constraints view
@@ -0,0 +1,55 @@+constraints: MonadRandom == 0.1.13+ , array == 0.5.0.0+ , attoparsec == 0.11.3.4+ , base == 4.7.0.0+ , base-unicode-symbols == 0.2.2.4+ , blaze-builder == 0.3.3.2+ , bytestring == 0.10.4.0+ , case-insensitive == 1.2.0.0+ , charset == 0.3.7+ , comonad == 4.2+ , conduit == 1.1.2.1+ , conduit-extra == 1.1.0.3+ , containers == 0.5.5.1+ , contravariant == 0.5.1+ , deepseq == 1.3.0.2+ , directory == 1.2.1.0+ , distributive == 0.4.3.2+ , either == 4.1.2+ , errors == 1.4.7+ , exceptions == 0.6.1+ , filepath == 1.3.0.2+ , ghc-prim == 0.3.1.0+ , hashable == 1.2.2.0+ , http-types == 0.8.4+ , integer-gmp == 0.5.1.0+ , lifted-base == 0.2.2.2+ , mmorph == 1.0.3+ , monad-control == 0.3.3.0+ , mtl == 2.1.3.1+ , nats == 0.2+ , network == 2.5.0.0+ , old-locale == 1.0.0.6+ , parsec == 3.1.5+ , parsers == 0.11.0.1+ , primitive == 0.5.3.0+ , random == 1.0.1.1+ , resourcet == 1.1.2.2+ , rts == 1.0+ , safe == 0.3.4+ , scientific == 0.3.2.0+ , semigroupoids == 4.0.2+ , semigroups == 0.14+ , streaming-commons == 0.1.2.4+ , tagged == 0.7.2+ , text == 1.1.1.2+ , time == 1.4.2+ , transformers == 0.3.0.0+ , transformers-base == 0.4.2+ , transformers-compat == 0.1.1.1+ , unix == 2.7.0.1+ , unordered-containers == 0.2.4.0+ , vault == 0.3.0.3+ , void == 0.6.1+ , wai == 2.1.0.2+ , zlib == 0.5.4.1
src/Network/Wai/Middleware/Cors.hs view
@@ -15,8 +15,11 @@ -- aims to be compliant with <http://www.w3.org/TR/cors>. -- module Network.Wai.Middleware.Cors-( CorsResourcePolicy(..)+( Origin+, CorsResourcePolicy(..)+, simpleCorsResourcePolicy , cors+, simpleCors -- * Utils , isSimple@@ -112,6 +115,43 @@ } deriving (Show,Read,Eq,Ord) +-- | A 'CorsResourcePolicy' that supports /simple cross-origin requests/ as defined+-- in <http://www.w3.org/TR/cors/>.+--+-- * The HTTP header @Access-Control-Allow-Origin@ is set to @*@.+--+-- * Request methods are constraint to /simple methods/ (@GET@, @HEAD@, @POST@).+--+-- * Request headers are constraint to /simple request headers/+-- (@Accept@, @Accept-Language@, @Content-Language@, @Content-Type@).+--+-- * If the request is a @POST@ request the content type is constraint to+-- /simple content types/+-- (@application/x-www-form-urlencoded@, @multipart/form-data@, @text/plain@),+--+-- * Only /simple response headers/ may be exposed on the client+-- (@Cache-Control@, @Content-Language@, @Content-Type@, @Expires@, @Last-Modified@, @Pragma@)+--+-- * The @Vary-Origin@ header is left unchanged (possibly unset).+--+-- * In case of a protocol failure the response is of status 200 along with+-- an empty body.+--+-- For /simple cross-origin requests/ a preflight request is not required. However, if+-- the client chooses to make a preflight request it is answered in accordance with+-- the policy for /simple cross-origin requests/.+--+simpleCorsResourcePolicy ∷ CorsResourcePolicy+simpleCorsResourcePolicy = CorsResourcePolicy+ { corsOrigins = Nothing+ , corsMethods = simpleMethods+ , corsRequestHeaders = []+ , corsExposedHeaders = Nothing+ , corsMaxAge = Nothing+ , corsVaryOrigin = False+ , corsVerboseResponse = False+ }+ -- | A Cross-Origin resource sharing (CORS) middleware. -- -- The middleware is given a function that serves as a pattern to decide@@ -119,8 +159,10 @@ -- 'Nothing' the request is passed unmodified to the inner application. -- -- The current version of this module does only aim at compliance with the CORS--- protocol as specified in <http://www.w3.org/TR/cors/>. It does not implement--- any enforcement of authorization policies that are possibly implied by the+-- protocol as specified in <http://www.w3.org/TR/cors/>. In accordance with+-- that standard the role of the server side is to support the client to+-- enforce CORS restrictions. This module does not implement any enforcement of+-- authorization policies that are possibly implied by the -- 'CorsResourcePolicy'. It is up to the inner WAI application to enforce such -- policy and make sure that it is in accordance with the configuration of the -- 'cors' middleware.@@ -272,6 +314,20 @@ respCorsHeaders policy = catMaybes [ fmap (\x → ("Access-Control-Expose-Headers", hdrLI x)) (corsExposedHeaders policy) ]++-- | A CORS middleware that supports simple cross-origin requests for all+-- resources.+--+-- It does not check if the resource corresponds to the restrictions for+-- simple requests. This is in accordance with <http://www.w3.org/TR/cors/>.+-- The client (user-agent) is supposed to enforcement CORS policy. The+-- role of the server to provide the client with the respective policy constraints.+--+-- It is out of the scope of the this middleware if the server chooses to+-- enforce rules on its resources in relation to CORS policy itself.+--+simpleCors ∷ WAI.Middleware+simpleCors = cors (const $ Just simpleCorsResourcePolicy) -- -------------------------------------------------------------------------- -- -- Definition from Standards
+ test/index.html view
@@ -0,0 +1,65 @@+<!DOCTYPE html>+<html>+ <head> + <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.0/jquery.min.js"></script>+ <script type="text/javascript">++ var url = 'http://localhost:8080'+ var simpleTest = function (label, result, method, creds, contentType, headers) {++ var xhr = new XMLHttpRequest();+ xhr.open(method, url, true);++ var succ = function() {+ $('#results').append('<p style="color:green">' + label + ': success</p>')+ };++ var fail = function() {+ $('#results').append('<p style="color:red">' + label + ': failure</p>')+ };++ xhr.onerror = result ? fail : succ;+ xhr.onload = result ? succ : fail;++ xhr.setRequestHeader('content-type', contentType);++ for (var i = 0; i < headers.length; ++i) {+ var e = headers[i];+ xhr.setRequestHeader(e[1], e[2]);+ }+ xhr.send();+ }++ $(document).ready(function() {+ simpleTest("simple GET 1", true, "GET", false, 'text/plain', []);+ simpleTest("simple GET 2", true, "GET", false, 'application/x-www-form-urlencoded', []);+ simpleTest("simple GET 3", true, "GET", false, 'multipart/form-data', []);+ simpleTest("simple GET 4", false, "GET", false, 'application/json', []);+ simpleTest("simple GET 5", false, "GET", false, 'text/plain', [['abc','abc']]);++ simpleTest("simple HEAD 1", true, "HEAD", false, 'text/plain', []);+ simpleTest("simple HEAD 2", true, "HEAD", false, 'application/x-www-form-urlencoded', []);+ simpleTest("simple HEAD 3", true, "HEAD", false, 'multipart/form-data', []);+ simpleTest("simple HEAD 4", false, "HEAD", false, 'application/json', []);+ simpleTest("simple HEAD 5", false, "HEAD", false, 'text/plain', [['abc','abc']]);++ simpleTest("simple POST 1", true, "POST", false, 'text/plain', []);+ simpleTest("simple POST 2", true, "POST", false, 'application/x-www-form-urlencoded', []);+ simpleTest("simple POST 3", true, "POST", false, 'multipart/form-data', []);+ simpleTest("simple POST 4", false, "POST", false, 'application/json', []);+ simpleTest("simple POST 5", false, "POST", false, 'test/plain', [['abc','abc']]);++ simpleTest("simple PUT 1", false, "PUT", false, 'text/plain', []);+ simpleTest("simple DELETE 1", false, "DELETE", false, 'text/plain', []);+ simpleTest("simple PATCH 1", false, "PATCH", false, 'text/plain', []);+ });++ </script>+ </head>+ <body>+ <h1>Results</h1>+ <div id="results"/>+ </body>+</html>++
+ test/server.hs view
@@ -0,0 +1,19 @@+-- ------------------------------------------------------ --+-- Copyright © 2014 AlephCloud Systems, Inc.+-- ------------------------------------------------------ --++{-# LANGUAGE UnicodeSyntax #-}+{-# LANGUAGE OverloadedStrings #-}++module Main+( main+) where++import Network.Wai.Middleware.Cors+import Web.Scotty++main ∷ IO ()+main = scotty 8080 $ do+ middleware simpleCors+ matchAny "/" $ text "Success"+
wai-cors.cabal view
@@ -3,7 +3,7 @@ -- ------------------------------------------------------ -- Name: wai-cors-Version: 0.1.1+Version: 0.1.2 Synopsis: CORS for WAI Description:@@ -24,7 +24,9 @@ data-files: README.md CHANGELOG.md- Confirmed-Constraints+ constraints+ test/index.html+ test/server.hs source-repository head type: git