18 lines
726 B
JavaScript
18 lines
726 B
JavaScript
// CORS fuer das Ticketsystem (Bearer-JWT, keine Cookies). Die X-*-Header braucht der Chat-Upload.
|
|
const ALLOW_HEADERS = 'Authorization, Content-Type, X-File-Name, X-Attachment-Kind, X-Duration-Ms, X-Image-Width, X-Image-Height'
|
|
|
|
export function corsMiddleware(allowedOrigins) {
|
|
return (req, res, next) => {
|
|
const origin = req.get('Origin')
|
|
if (origin && allowedOrigins.includes(origin)) {
|
|
res.setHeader('Access-Control-Allow-Origin', origin)
|
|
res.setHeader('Access-Control-Allow-Headers', ALLOW_HEADERS)
|
|
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS')
|
|
if (req.method === 'OPTIONS') {
|
|
return res.sendStatus(204)
|
|
}
|
|
}
|
|
return next()
|
|
}
|
|
}
|