diff --git a/CHANGELOG.md b/CHANGELOG.md --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,18 @@ +0.1.2 +===== + +* Export type synonym `Origin` + +* New easy-to-use middleware function `simpleCors` that supports just + simple cross-origin requests + +* The new value `simpleCorseResourcePolicy` is a `CorseResourcePolicy` + for simple cross-origin requests. + +* Documentation has been slightly improved + +* Some code for testing `simpleCors` from a browser + 0.1.1 ===== diff --git a/Confirmed-Constraints b/Confirmed-Constraints deleted file mode 100644 --- a/Confirmed-Constraints +++ /dev/null @@ -1,51 +0,0 @@ -constraints: MonadRandom == 0.1.12 - , array == 0.4.0.1 - , attoparsec == 0.11.2.1 - , base == 4.6.0.1 - , base-unicode-symbols == 0.2.2.4 - , blaze-builder == 0.3.3.2 - , bytestring == 0.10.4.0 - , case-insensitive == 1.1.0.3 - , charset == 0.3.7 - , comonad == 4.0 - , conduit == 1.0.15.1 - , containers == 0.5.0.0 - , contravariant == 0.4.4 - , deepseq == 1.3.0.1 - , directory == 1.2.0.1 - , distributive == 0.4 - , either == 4.1.1 - , errors == 1.4.5 - , filepath == 1.3.0.1 - , ghc-prim == 0.3.0.0 - , hashable == 1.2.1.0 - , http-types == 0.8.3 - , integer-gmp == 0.5.0.0 - , lifted-base == 0.2.1.1 - , mmorph == 1.0.2 - , monad-control == 0.3.2.2 - , mtl == 2.1.2 - , nats == 0.1.2 - , network == 2.4.2.2 - , old-locale == 1.0.0.5 - , parsec == 3.1.5 - , parsers == 0.11 - , random == 1.0.1.1 - , resourcet == 0.4.10 - , rts == 1.0 - , safe == 0.3.3 - , scientific == 0.2.0.2 - , semigroupoids == 4.0 - , semigroups == 0.12.2 - , tagged == 0.7 - , text == 1.1.0.1 - , text-stream-decode == 0.1.0.4 - , time == 1.4.0.1 - , transformers == 0.3.0.0 - , transformers-base == 0.4.1 - , transformers-compat == 0.1.1.1 - , unix == 2.7.0.0 - , unordered-containers == 0.2.3.3 - , vault == 0.3.0.3 - , void == 0.6.1 - , wai == 1.4.1 diff --git a/README.md b/README.md --- a/README.md +++ b/README.md @@ -6,3 +6,45 @@ that aims to be compliant with [http://www.w3.org/TR/cors](http://www.w3.org/TR/cors). +Usage +----- + +The file `test/server.hs` shows how to support simple cross-origin requests (as +defined in [http://www.w3.org/TR/cors](http://www.w3.org/TR/cors)) in a +[scotty](http://hackage.haskell.org/package/scotty) application. + +~~~{.haskell} +{-# LANGUAGE UnicodeSyntax #-} +{-# LANGUAGE OverloadedStrings #-} + +module Main +( main +) where + +import Network.Wai.Middleware.Cors +import Web.Scotty + +main ∷ IO () +main = scotty 8080 $ do + middleware simpleCors + matchAny "/" $ text "Success" +~~~ + +Documentation for more general usage can be found in the module +[Network.Wai.Middleware.Cors](http://hackage.haskell.org/package/wai-cors/docs/Network-Wai-Middleware-Cors.html). + +TEST +---- + +Currently there is only basic support to test simple cross-origin +request from a browser. + +Start server: + +~~~{.bash} +cd test +runHaskell server.hs +~~~ + +Open the file `test/index.html` in a modern web-browser in order to run some +simple tests. diff --git a/constraints b/constraints new file mode 100644 --- /dev/null +++ b/constraints @@ -0,0 +1,55 @@ +constraints: MonadRandom == 0.1.13 + , array == 0.5.0.0 + , attoparsec == 0.11.3.4 + , base == 4.7.0.0 + , base-unicode-symbols == 0.2.2.4 + , blaze-builder == 0.3.3.2 + , bytestring == 0.10.4.0 + , case-insensitive == 1.2.0.0 + , charset == 0.3.7 + , comonad == 4.2 + , conduit == 1.1.2.1 + , conduit-extra == 1.1.0.3 + , containers == 0.5.5.1 + , contravariant == 0.5.1 + , deepseq == 1.3.0.2 + , directory == 1.2.1.0 + , distributive == 0.4.3.2 + , either == 4.1.2 + , errors == 1.4.7 + , exceptions == 0.6.1 + , filepath == 1.3.0.2 + , ghc-prim == 0.3.1.0 + , hashable == 1.2.2.0 + , http-types == 0.8.4 + , integer-gmp == 0.5.1.0 + , lifted-base == 0.2.2.2 + , mmorph == 1.0.3 + , monad-control == 0.3.3.0 + , mtl == 2.1.3.1 + , nats == 0.2 + , network == 2.5.0.0 + , old-locale == 1.0.0.6 + , parsec == 3.1.5 + , parsers == 0.11.0.1 + , primitive == 0.5.3.0 + , random == 1.0.1.1 + , resourcet == 1.1.2.2 + , rts == 1.0 + , safe == 0.3.4 + , scientific == 0.3.2.0 + , semigroupoids == 4.0.2 + , semigroups == 0.14 + , streaming-commons == 0.1.2.4 + , tagged == 0.7.2 + , text == 1.1.1.2 + , time == 1.4.2 + , transformers == 0.3.0.0 + , transformers-base == 0.4.2 + , transformers-compat == 0.1.1.1 + , unix == 2.7.0.1 + , unordered-containers == 0.2.4.0 + , vault == 0.3.0.3 + , void == 0.6.1 + , wai == 2.1.0.2 + , zlib == 0.5.4.1 diff --git a/src/Network/Wai/Middleware/Cors.hs b/src/Network/Wai/Middleware/Cors.hs --- a/src/Network/Wai/Middleware/Cors.hs +++ b/src/Network/Wai/Middleware/Cors.hs @@ -15,8 +15,11 @@ -- aims to be compliant with . -- module Network.Wai.Middleware.Cors -( CorsResourcePolicy(..) +( Origin +, CorsResourcePolicy(..) +, simpleCorsResourcePolicy , cors +, simpleCors -- * Utils , isSimple @@ -112,6 +115,43 @@ } deriving (Show,Read,Eq,Ord) +-- | A 'CorsResourcePolicy' that supports /simple cross-origin requests/ as defined +-- in . +-- +-- * The HTTP header @Access-Control-Allow-Origin@ is set to @*@. +-- +-- * Request methods are constraint to /simple methods/ (@GET@, @HEAD@, @POST@). +-- +-- * Request headers are constraint to /simple request headers/ +-- (@Accept@, @Accept-Language@, @Content-Language@, @Content-Type@). +-- +-- * If the request is a @POST@ request the content type is constraint to +-- /simple content types/ +-- (@application/x-www-form-urlencoded@, @multipart/form-data@, @text/plain@), +-- +-- * Only /simple response headers/ may be exposed on the client +-- (@Cache-Control@, @Content-Language@, @Content-Type@, @Expires@, @Last-Modified@, @Pragma@) +-- +-- * The @Vary-Origin@ header is left unchanged (possibly unset). +-- +-- * In case of a protocol failure the response is of status 200 along with +-- an empty body. +-- +-- For /simple cross-origin requests/ a preflight request is not required. However, if +-- the client chooses to make a preflight request it is answered in accordance with +-- the policy for /simple cross-origin requests/. +-- +simpleCorsResourcePolicy ∷ CorsResourcePolicy +simpleCorsResourcePolicy = CorsResourcePolicy + { corsOrigins = Nothing + , corsMethods = simpleMethods + , corsRequestHeaders = [] + , corsExposedHeaders = Nothing + , corsMaxAge = Nothing + , corsVaryOrigin = False + , corsVerboseResponse = False + } + -- | A Cross-Origin resource sharing (CORS) middleware. -- -- The middleware is given a function that serves as a pattern to decide @@ -119,8 +159,10 @@ -- 'Nothing' the request is passed unmodified to the inner application. -- -- The current version of this module does only aim at compliance with the CORS --- protocol as specified in . It does not implement --- any enforcement of authorization policies that are possibly implied by the +-- protocol as specified in . In accordance with +-- that standard the role of the server side is to support the client to +-- enforce CORS restrictions. This module does not implement any enforcement of +-- authorization policies that are possibly implied by the -- 'CorsResourcePolicy'. It is up to the inner WAI application to enforce such -- policy and make sure that it is in accordance with the configuration of the -- 'cors' middleware. @@ -272,6 +314,20 @@ respCorsHeaders policy = catMaybes [ fmap (\x → ("Access-Control-Expose-Headers", hdrLI x)) (corsExposedHeaders policy) ] + +-- | A CORS middleware that supports simple cross-origin requests for all +-- resources. +-- +-- It does not check if the resource corresponds to the restrictions for +-- simple requests. This is in accordance with . +-- The client (user-agent) is supposed to enforcement CORS policy. The +-- role of the server to provide the client with the respective policy constraints. +-- +-- It is out of the scope of the this middleware if the server chooses to +-- enforce rules on its resources in relation to CORS policy itself. +-- +simpleCors ∷ WAI.Middleware +simpleCors = cors (const $ Just simpleCorsResourcePolicy) -- -------------------------------------------------------------------------- -- -- Definition from Standards diff --git a/test/index.html b/test/index.html new file mode 100644 --- /dev/null +++ b/test/index.html @@ -0,0 +1,65 @@ + + + + + + + +

Results

+
+ + + + diff --git a/test/server.hs b/test/server.hs new file mode 100644 --- /dev/null +++ b/test/server.hs @@ -0,0 +1,19 @@ +-- ------------------------------------------------------ -- +-- Copyright © 2014 AlephCloud Systems, Inc. +-- ------------------------------------------------------ -- + +{-# LANGUAGE UnicodeSyntax #-} +{-# LANGUAGE OverloadedStrings #-} + +module Main +( main +) where + +import Network.Wai.Middleware.Cors +import Web.Scotty + +main ∷ IO () +main = scotty 8080 $ do + middleware simpleCors + matchAny "/" $ text "Success" + diff --git a/wai-cors.cabal b/wai-cors.cabal --- a/wai-cors.cabal +++ b/wai-cors.cabal @@ -3,7 +3,7 @@ -- ------------------------------------------------------ -- Name: wai-cors -Version: 0.1.1 +Version: 0.1.2 Synopsis: CORS for WAI Description: @@ -24,7 +24,9 @@ data-files: README.md CHANGELOG.md - Confirmed-Constraints + constraints + test/index.html + test/server.hs source-repository head type: git