kylefang/react-native
1
0
Fork 0
mirror of https://github.com/zhigang1992/react-native.git synced 2026-04-23 11:57:46 +08:00
Code Issues Packages Projects Releases Wiki Activity

Prevent cross origin requests to development server

Browse Source 
Summary:
This diff adds a middleware to the RN development server to prevent processing requests coming from a third-party website.

The way we choose to do it is to block any request that has an origin header and it's different than localhost. This will still allow simulators to work properly while blocking potential external websites to do malign CORS requests.

This is just a first quick measure to block a potential attack vector while we implement full authentication in the RN development server

Reviewed By: mjesun

Differential Revision: D9238674

fbshipit-source-id: b7bdc40dabc2f4d92f5ac84515f93b89efa4e833
This commit is contained in:
Rafael Oleza
2018-08-22 09:52:05 -07:00
committed by Facebook Github Bot
parent 6af3b161c0
commit 8a21abcd6b
2 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
local-cli/server/middleware/MiddlewareManager.js
View File

@@ -17,6 +17,7 @@ const WebSocketServer = require('ws').Server;
const indexPageMiddleware = require('./indexPage');
const copyToClipBoardMiddleware = require('./copyToClipBoardMiddleware');
const getSecurityHeadersMiddleware = require('./getSecurityHeadersMiddleware');
const loadRawBodyMiddleware = require('./loadRawBodyMiddleware');
const openStackFrameInEditorMiddleware = require('./openStackFrameInEditorMiddleware');
const statusPageMiddleware = require('./statusPageMiddleware');
@@ -44,6 +45,7 @@ module.exports = class MiddlewareManager {
this.options = options;
this.app = connect()
.use(getSecurityHeadersMiddleware)
.use(loadRawBodyMiddleware)
.use(compression())
.use('/debugger-ui', serveStatic(debuggerUIFolder))