6 |
7 |
--------------------------------------------------------------------------------
/.travis.yml:
--------------------------------------------------------------------------------
1 | language: node_js
2 | node_js:
3 | - 0.10
4 | - 4
5 | - 6
6 | - 7
7 | - 8
8 | - 9
9 | - 11
10 | - 12
11 | - 13
12 | - 13
13 | - 14
14 | - 15
15 | script:
16 | - npm run lint
17 | - npm run test
18 | - npm run test-coverage && cat coverage/lcov.info | ./node_modules/.bin/coveralls && rm -rf coverage
19 |
--------------------------------------------------------------------------------
/test/cert.pem:
--------------------------------------------------------------------------------
1 | -----BEGIN CERTIFICATE-----
2 | MIIBsTCCARoCCQDp0DuED0RAJzANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDDBJj
3 | b3JzLWFueXdoZXJlIHRlc3QwHhcNMTUwNTA2MDcyOTM1WhcNMTUwNjA1MDcyOTM1
4 | WjAdMRswGQYDVQQDDBJjb3JzLWFueXdoZXJlIHRlc3QwgZ8wDQYJKoZIhvcNAQEB
5 | BQADgY0AMIGJAoGBALzTF5ClJKvkB6h9h7kLORV+mMV3ySDs+oGZn0NgXM+yb9Zh
6 | 69r5e95zZJl/V432LFdy0hkEcVteUkC2REWG8D4COGfiwWsXyZdaP1qqLpDpPAMm
7 | v6xFHjW6rVuxzfr4GUjE0Zh9Fg2R2SbtCOcHS/LZoDVOqOvn6+urP6XFY4aFAgMB
8 | AAEwDQYJKoZIhvcNAQELBQADgYEAYXMhS8ouff/c8lSUUs/CLh010cj5RPk/ivS7
9 | aN2PArzQ6pZvhpgJKf7XAQksBtLYYZMzIpG6W8zhPSbqzly7lELAdE+sxcbbfu8A
10 | FMjNVFQ2Fm1c8ImX8qpE3nhVrPAiwfPjGBqKHTl730gvbh1XH9TC4O4dZcbEomX3
11 | 5MsxQfc=
12 | -----END CERTIFICATE-----
13 |
--------------------------------------------------------------------------------
/.eslintrc:
--------------------------------------------------------------------------------
1 | {
2 | "env": {
3 | "node": true
4 | },
5 | "rules": {
6 | "array-bracket-spacing": [2, "never"],
7 | "block-scoped-var": 2,
8 | "brace-style": [2, "1tbs", {"allowSingleLine": true}],
9 | "comma-dangle": [2, "always-multiline"],
10 | "computed-property-spacing": [2, "never"],
11 | "curly": 2,
12 | "eol-last": 2,
13 | "eqeqeq": [2, "smart"],
14 | "max-len": [1, 125],
15 | "new-cap": 1,
16 | "no-extend-native": 2,
17 | "no-mixed-spaces-and-tabs": 2,
18 | "no-trailing-spaces": 2,
19 | "no-undef": 2,
20 | "no-unused-vars": 1,
21 | "no-use-before-define": [2, "nofunc"],
22 | "object-curly-spacing": [2, "never"],
23 | "quotes": [2, "single", "avoid-escape"],
24 | "semi": [2, "always"],
25 | "keyword-spacing": 2,
26 | "space-unary-ops": 2
27 | }
28 | }
29 |
--------------------------------------------------------------------------------
/test/key.pem:
--------------------------------------------------------------------------------
1 | -----BEGIN RSA PRIVATE KEY-----
2 | MIICXQIBAAKBgQC80xeQpSSr5AeofYe5CzkVfpjFd8kg7PqBmZ9DYFzPsm/WYeva
3 | +Xvec2SZf1eN9ixXctIZBHFbXlJAtkRFhvA+Ajhn4sFrF8mXWj9aqi6Q6TwDJr+s
4 | RR41uq1bsc36+BlIxNGYfRYNkdkm7QjnB0vy2aA1Tqjr5+vrqz+lxWOGhQIDAQAB
5 | AoGBAISy8OelN01Zlowxk/VWTsqtSl3UHdP21uHHfWaTTQZlxzTpYiBknkmp3LQH
6 | CxfoPidCuSX9ulBUzAdQUFBwUVp8wyPIRjpNyRiD58dLNxG0G+OACqnLxNWqIf6F
7 | vS3UqrRGIA5u+GSz+0g3DAeVA5JmsAyHQGkJsh3pcuD8/7wNAkEA7MScGfySy9td
8 | dDBekVU5/GaVg4DA4ELtDNfa99ARB89XP0ps/XrOPEL9yxTjWIHH+qxuhpfG6zGN
9 | ouxZlvBT9wJBAMwpig4A4JE8M8pBDwMY4213gud8B1grQTbhz5bv51aTaIEQFcxw
10 | sGfEmAfVToI+kVTrdFggy42YCSMSvwuF4mMCQQDZHkqPwf/TlSwT2i8+UstD28aL
11 | uswkWvsKZf9UdKbJZKd7UIK1x6HLvRsC2frJNOnvw6PvJMuy7dQWbWqScXxtAkBv
12 | /5msdO68vbnriiUiHdUliBpXwsKEq7Xq1ZV7x7+wzszVgG106ZzcUAzWvz2CVbCE
13 | VWZNsi/4TR82DmKff6LhAkBA/xceWaZjxh5dkWkIrMFWd2GFhGlpfwYw7oELwRL8
14 | RYXzc1Mr2fDdZDgwgjg67JQqIhOQ3E4RGKPgZ+E7Pk3/
15 | -----END RSA PRIVATE KEY-----
16 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | The MIT License
2 |
3 | Copyright (C) 2013 - 2021 Rob Wu
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy of
6 | this software and associated documentation files (the "Software"), to deal in
7 | the Software without restriction, including without limitation the rights to
8 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
9 | of the Software, and to permit persons to whom the Software is furnished to do
10 | so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/package.json:
--------------------------------------------------------------------------------
1 | {
2 | "name": "cors-anywhere",
3 | "version": "0.4.11",
4 | "description": "CORS Anywhere is a reverse proxy which adds CORS headers to the proxied request. Request URL is taken from the path",
5 | "license": "MIT",
6 | "author": "Rob Wu ",
7 | "repository": {
8 | "type": "git",
9 | "url": "https://github.com/Rob--W/cors-anywhere.git"
10 | },
11 | "bugs": {
12 | "url": "https://github.com/Rob--W/cors-anywhere/issues/",
13 | "email": "rob@robwu.nl"
14 | },
15 | "keywords": [
16 | "cors",
17 | "cross-domain",
18 | "http-proxy",
19 | "proxy",
20 | "heroku"
21 | ],
22 | "main": "./lib/cors-anywhere.js",
23 | "files": [
24 | "lib/",
25 | "test/",
26 | "Procfile",
27 | "demo.html",
28 | "server.js"
29 | ],
30 | "dependencies": {
31 | "http-proxy": "1.11.1",
32 | "proxy-from-env": "0.0.1"
33 | },
34 | "devDependencies": {
35 | "coveralls": "^2.11.6",
36 | "eslint": "^2.2.0",
37 | "istanbul": "^0.4.2",
38 | "lolex": "^1.5.0",
39 | "mocha": "^3.4.2",
40 | "nock": "^8.2.1",
41 | "supertest": "^2.0.1"
42 | },
43 | "scripts": {
44 | "lint": "eslint .",
45 | "test": "mocha ./test/test*.js --reporter spec",
46 | "test-coverage": "istanbul cover ./node_modules/.bin/_mocha -- test/test.js test/test-ratelimit.js --reporter spec"
47 | },
48 | "engines": {
49 | "node": ">=0.10.0"
50 | }
51 | }
52 |
--------------------------------------------------------------------------------
/lib/help.txt:
--------------------------------------------------------------------------------
1 | This API enables cross-origin requests to anywhere.
2 |
3 | Usage:
4 |
5 | / Shows help
6 | /iscorsneeded This is the only resource on this host which is served without CORS headers.
7 | / Create a request to , and includes CORS headers in the response.
8 |
9 | If the protocol is omitted, it defaults to http (https if port 443 is specified).
10 |
11 | Cookies are disabled and stripped from requests.
12 |
13 | Redirects are automatically followed. For debugging purposes, each followed redirect results
14 | in the addition of a X-CORS-Redirect-n header, where n starts at 1. These headers are not
15 | accessible by the XMLHttpRequest API.
16 | After 5 redirects, redirects are not followed any more. The redirect response is sent back
17 | to the browser, which can choose to follow the redirect (handled automatically by the browser).
18 |
19 | The requested URL is available in the X-Request-URL response header.
20 | The final URL, after following all redirects, is available in the X-Final-URL response header.
21 |
22 |
23 | To prevent the use of the proxy for casual browsing, the API requires either the Origin
24 | or the X-Requested-With header to be set. To avoid unnecessary preflight (OPTIONS) requests,
25 | it's recommended to not manually set these headers in your code.
26 |
27 |
28 | Demo : https://robwu.nl/cors-anywhere.html
29 | Source code : https://github.com/Rob--W/cors-anywhere/
30 | Documentation : https://github.com/Rob--W/cors-anywhere/#documentation
31 |
--------------------------------------------------------------------------------
/server.js:
--------------------------------------------------------------------------------
1 | // Listen on a specific host via the HOST environment variable
2 | var host = process.env.HOST || '0.0.0.0';
3 | // Listen on a specific port via the PORT environment variable
4 | var port = process.env.PORT || 8080;
5 |
6 | // Grab the blacklist from the command-line so that we can update the blacklist without deploying
7 | // again. CORS Anywhere is open by design, and this blacklist is not used, except for countering
8 | // immediate abuse (e.g. denial of service). If you want to block all origins except for some,
9 | // use originWhitelist instead.
10 | var originBlacklist = parseEnvList(process.env.CORSANYWHERE_BLACKLIST);
11 | var originWhitelist = parseEnvList(process.env.CORSANYWHERE_WHITELIST);
12 | function parseEnvList(env) {
13 | if (!env) {
14 | return [];
15 | }
16 | return env.split(',');
17 | }
18 |
19 | // Set up rate-limiting to avoid abuse of the public CORS Anywhere server.
20 | var checkRateLimit = require('./lib/rate-limit')(process.env.CORSANYWHERE_RATELIMIT);
21 |
22 | var cors_proxy = require('./lib/cors-anywhere');
23 | cors_proxy.createServer({
24 | originBlacklist: originBlacklist,
25 | originWhitelist: originWhitelist,
26 | requireHeader: ['origin', 'x-requested-with'],
27 | checkRateLimit: checkRateLimit,
28 | removeHeaders: [
29 | 'cookie',
30 | 'cookie2',
31 | // Strip Heroku-specific headers
32 | 'x-request-start',
33 | 'x-request-id',
34 | 'via',
35 | 'connect-time',
36 | 'total-route-time',
37 | // Other Heroku added debug headers
38 | // 'x-forwarded-for',
39 | // 'x-forwarded-proto',
40 | // 'x-forwarded-port',
41 | ],
42 | redirectSameOrigin: true,
43 | httpProxyOptions: {
44 | // Do not add X-Forwarded-For, etc. headers, because Heroku already adds it.
45 | xfwd: false,
46 | },
47 | }).listen(port, host, function() {
48 | console.log('Running CORS Anywhere on ' + host + ':' + port);
49 | });
50 |
--------------------------------------------------------------------------------
/test/child.js:
--------------------------------------------------------------------------------
1 | // When this module is loaded, CORS Anywhere is started.
2 | // Then, a request is generated to warm up the server (just in case).
3 | // Then the base URL of CORS Anywhere is sent to the parent process.
4 | // ...
5 | // When the parent process is done, it sends an empty message to this child
6 | // process, which in turn records the change in used heap space.
7 | // The difference in heap space is finally sent back to the parent process.
8 | // ...
9 | // The parent process should then kill this child.
10 |
11 | process.on('uncaughtException', function(e) {
12 | console.error('Uncaught exception in child process: ' + e);
13 | console.error(e.stack);
14 | process.exit(-1);
15 | });
16 |
17 | // Invoke memoryUsage() without using its result to make sure that any internal
18 | // datastructures that supports memoryUsage() is initialized and won't pollute
19 | // the memory usage measurement later on.
20 | process.memoryUsage();
21 |
22 | var heapUsedStart = 0;
23 | function getMemoryUsage(callback) {
24 | // Note: Requires --expose-gc
25 | // 6 is the minimum amount of gc() calls before calling gc() again does not
26 | // reduce memory any more.
27 | for (var i = 0; i < 6; ++i) {
28 | global.gc();
29 | }
30 | callback(process.memoryUsage().heapUsed);
31 | }
32 |
33 | var server;
34 | if (process.argv.indexOf('use-http-instead-of-cors-anywhere') >= 0) {
35 | server = require('http').createServer(function(req, res) { res.end(); });
36 | } else {
37 | server = require('../').createServer();
38 | }
39 |
40 | server.listen(0, function() {
41 | // Perform 1 request to warm up.
42 | require('http').get({
43 | hostname: '127.0.0.1',
44 | port: server.address().port,
45 | path: '/http://invalid:99999',
46 | agent: false,
47 | }, function() {
48 | notifyParent();
49 | });
50 |
51 | function notifyParent() {
52 | getMemoryUsage(function(usage) {
53 | heapUsedStart = usage;
54 | process.send('http://127.0.0.1:' + server.address().port + '/');
55 | });
56 | }
57 | });
58 |
59 | process.once('message', function() {
60 | getMemoryUsage(function(heapUsedEnd) {
61 | var delta = heapUsedEnd - heapUsedStart;
62 | process.send(delta);
63 | });
64 | });
65 |
--------------------------------------------------------------------------------
/demo.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Demo of CORS Anywhere
6 |
7 |
46 |
47 |
48 |