{"_id":"cors-gate","_rev":"222-962249ea1c9196f049dca6ec5465694a","name":"cors-gate","dist-tags":{"latest":"1.1.3"},"versions":{"1.0.0":{"name":"cors-gate","version":"1.0.0","author":{"url":"https://mixmax.com","name":"Jeff Wear","email":"jeff@mixmax.com"},"license":"MIT","_id":"cors-gate@1.0.0","maintainers":[{"name":"skeggse","email":"skeggse@gmail.com"}],"contributors":[{"url":"https://mixmax.com","name":"Eli Skeggs","email":"eli@mixmax.com"}],"dist":{"shasum":"ecba297979133856c4829475072c2ea3397af71e","tarball":"https://registry.npmjs.org/cors-gate/-/cors-gate-1.0.0.tgz","integrity":"sha512-xeFtAEWCa1bfGeIY+omOyl4ISX7UmQjM7QFsxljBTzJq7iPyuspinnH3qMq7clFjFrwxTDgnxAneZv9unGLiuw==","signatures":[{"sig":"MEUCIEteCOtHSovT0AK5qnIOMsiJqKmB75snsPPyhKAeGFS+AiEAiSqXq9BpIlSaArwEzWFvLlneEKeXee5czm1SepTgIg0=","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA"}]},"main":"index.js","_from":".","_shasum":"ecba297979133856c4829475072c2ea3397af71e","gitHead":"5d513ee017572b27fd79eb670d5fcb01ad832e6c","scripts":{"test":"mocha"},"_npmUser":{"name":"skeggse","email":"skeggse@gmail.com"},"_npmVersion":"3.10.8","description":"Gate requests based on CORS data.","directories":{},"_nodeVersion":"6.9.1","devDependencies":{"cors":"^2.8.3","mocha":"^3.3.0","express":"^4.15.2","supertest":"^3.0.0"},"_npmOperationalInternal":{"tmp":"tmp/cors-gate-1.0.0.tgz_1494544421567_0.8441179895307869","host":"packages-12-west.internal.npmjs.com"}},"2.0.2":{"name":"cors-gate","version":"2.0.2","author":{"url":"https://mixmax.com","name":"Jeff Wear","email":"jeff@mixmax.com"},"license":"MIT","_id":"cors-gate@2.0.2","maintainers":[{"name":"andytran","email":"hello@andytran.me"},{"name":"bradvogel","email":"bradavogel@gmail.com"},{"name":"chanpory","email":"junk@rith.com"},{"name":"chuy-mixmax","email":"chuy@mixmax.com"},{"name":"enricribas","email":"ribas.enric@gmail.com"},{"name":"gaastonsr","email":"gaastonsr@gmail.com"},{"name":"ghmeier","email":"meier.garret@gmail.com"},{"name":"jcperez91","email":"j.perez@outlook.com"},{"name":"jpdstan","email":"stan@mixmax.com"},{"name":"logandavis","email":"logankeahidavis@gmail.com"},{"name":"mixmax-codeship","email":"admin+mixmax-codeship-npm@mixmax.com"},{"name":"mixmaxryan","email":"ryan@mixmax.com"},{"name":"olofster","email":"olofmathe@hotmail.com"},{"name":"pricj004","email":"pricj004@gmail.com"},{"name":"ryanbrunner","email":"ryan@ryanbrunner.ca"},{"name":"sbalaji1996","email":"srinand@mixmax.com"},{"name":"shils","email":"shil.sinha@gmail.com"},{"name":"skeggse","email":"skeggse@gmail.com"},{"name":"tleavitt","email":"tucker@mixmax.com"},{"name":"ttacon","email":"ttacon@gmail.com"},{"name":"wearhere","email":"jeffreywear@gmail.com"}],"contributors":[{"url":"https://mixmax.com","name":"Eli Skeggs","email":"eli@mixmax.com"}],"homepage":"https://github.com/mixmaxhq/cors-gate#readme","bugs":{"url":"https://github.com/mixmaxhq/cors-gate/issues"},"dist":{"shasum":"edb85e2263552ff489125043b56cd157e92e2eaa","tarball":"https://registry.npmjs.org/cors-gate/-/cors-gate-2.0.2.tgz","fileCount":11,"integrity":"sha512-W+y6COoKPzu5gAb/XXTkwwB3WkUaG1FETracRwxEj41OP0bMky2QCr2NqbPA6bcKbFMFcZn/p/1S1ofuARgPTQ==","signatures":[{"sig":"MEQCIHzGcdf3JVdAZhu0L+8q3copPhzgskytvd7yQX7aqrfGAiBLqxwv8iVmY/J17DMeJZ/GEmx0NnAysc6EYODmplZ/sg==","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA"}],"unpackedSize":18166,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJcgDxxCRA9TVsSAnZWagAAquUP/2mPTXc/r235W2K9Pg/H\nJBiAMWpuaeNQ2UqINMP5ZLD+ZtfMKdl4BRCfYlDr/HLShKsSGQXDGWKBfcuB\nKk3oWAdrLD2Ncz3z3xMGfpjGrKl8wlYWznDm4JBNx4rRy4YVkz0gzoEOyBsK\n0UmDD0I1Eda3Xhe7gY8jCy2Rh+oaYmeD3Kw2NBc+Pug4HVErW0t/oyqyVStG\nYW6buytvqq+WLrfMGvSgCqwEvvaqBGdoLcAoDj9M/gc7pprbF/x/5WIR/mvx\ndfmE+wpa+yh88pdTHw4ymcWWNAEH4Cr3jh4V8pPME5O9zQccpTkKDJkb6j93\n0z8PZ08TYXYJG9giun0eh5AJqU+svsLDVNZ7Km7D/lCJlj7MqpBC1AIngjj6\nKjNUk9OYXlKBNMytwdnF3n8m073ozLw3iTgqCPge6uVh41ByvwTtNgQh47Xu\n/XMDvmgxV6C9MDPwuBQoXHv3ccYz9YnovxPR6zz0W/ZyWL3VAMnbRYn8R+wm\nmdGnqbBguXEo3hkfKr+f1+8bje0MODO7H+DU8z+EODZwNiSwalY6vtGSNJv6\nEb5j7oRnJiKwLDSsGizMmHneNgLzpr7PvzbuziiVIkOKdNpR5vR2Waqs27TW\nQ7JHYxsvZJb3gVDjL6OJgpT7zpSu/oP30mLaCHZaJBBMD61dPpy2UewMw7De\nmarO\r\n=n7kn\r\n-----END PGP SIGNATURE-----\r\n"},"main":"index.js","gitHead":"153656883522c2d3ace6f41ae02c5bbfe997932d","scripts":{"lint":"eslint .","test":"mocha"},"_npmUser":{"name":"ryanbrunner","email":"ryan@ryanbrunner.ca"},"pre-commit":["lint"],"repository":{"url":"git+ssh://git@github.com/mixmaxhq/cors-gate.git","type":"git"},"_npmVersion":"6.6.0","description":"Gate requests based on CORS data.","directories":{},"_nodeVersion":"8.9.3","_hasShrinkwrap":false,"devDependencies":{"cors":"^2.8.3","mocha":"^3.3.0","eslint":">=3","express":"^4.15.2","supertest":"^3.0.0","pre-commit":"^1.2.2","eslint-config-mixmax":"^0.6.0"},"_npmOperationalInternal":{"tmp":"tmp/cors-gate_2.0.2_1551907952715_0.18522607202647468","host":"s3://npm-registry-packages"}},"1.1.3":{"name":"cors-gate","version":"1.1.3","author":{"url":"https://mixmax.com","name":"Jeff Wear","email":"jeff@mixmax.com"},"license":"MIT","_id":"cors-gate@1.1.3","maintainers":[{"name":"andytran","email":"hello@andytran.me"},{"name":"bradvogel","email":"bradavogel@gmail.com"},{"name":"chanpory","email":"junk@rith.com"},{"name":"chuy-mixmax","email":"chuy@mixmax.com"},{"name":"enricribas","email":"ribas.enric@gmail.com"},{"name":"gaastonsr","email":"gaastonsr@gmail.com"},{"name":"ghmeier","email":"meier.garret@gmail.com"},{"name":"jcperez91","email":"j.perez@outlook.com"},{"name":"jpdstan","email":"stan@mixmax.com"},{"name":"logandavis","email":"logankeahidavis@gmail.com"},{"name":"mixmax-codeship","email":"admin+mixmax-codeship-npm@mixmax.com"},{"name":"mixmaxryan","email":"ryan@mixmax.com"},{"name":"olofster","email":"olofmathe@hotmail.com"},{"name":"pricj004","email":"pricj004@gmail.com"},{"name":"ryanbrunner","email":"ryan@ryanbrunner.ca"},{"name":"sbalaji1996","email":"srinand@mixmax.com"},{"name":"shils","email":"shil.sinha@gmail.com"},{"name":"skeggse","email":"skeggse@gmail.com"},{"name":"tleavitt","email":"tucker@mixmax.com"},{"name":"ttacon","email":"ttacon@gmail.com"},{"name":"wearhere","email":"jeffreywear@gmail.com"}],"contributors":[{"url":"https://mixmax.com","name":"Eli Skeggs","email":"eli@mixmax.com"}],"homepage":"https://github.com/mixmaxhq/cors-gate#readme","bugs":{"url":"https://github.com/mixmaxhq/cors-gate/issues"},"dist":{"shasum":"4ff964e958a94f78da2029f0f95842410d812d19","tarball":"https://registry.npmjs.org/cors-gate/-/cors-gate-1.1.3.tgz","fileCount":11,"integrity":"sha512-RFqvbbpj02lqKDhqasBEkgzmT3RseCH3DKy5sT2W9S1mhctABKQP3ktKcnKN0h8t4pJ2SneI3hPl3TGNi/VmZA==","signatures":[{"sig":"MEUCIH3yYSUNNt8l/11q6X0TZcz4U2x2TBeOJVzzj27+8RRNAiEA5Hl8D9gKC6qBDZGlRQucEvOMHZmFUs2Y2UXEXjKhFfA=","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA"}],"unpackedSize":17046,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJh2m4ICRA9TVsSAnZWagAAR+MP/1I7xGXCV/5LjGgIE9O2\nBRwwCa5azai6T8ZyBnWPnHVuW5EcD3M2pdWL6eYUg4khHOb40HT2Dk2rO3cp\neCEgOKVLG8FHUWDcs2L7+5K8d0Fifc+09ZnH5YK1T4OF6EUZWd3PmgKnzz5k\nn3lOGYZCPvTZsNBC0Oc5l2XJNhcZdZkzCkANHldpG7EVTBs8vStw8PZdnRWM\nm4uUhNMBeva8uzsp/VmZ0rub+ImiZwgtdJBNaXTQ4wUs+kXr2veCJ3brc7pd\nWT5Wn2tdo+JiWJimdt/1Ws7TvScvCHqbptnrCXKB0iqMhzOJgty4syk0+BF1\nIpzA088kVLSE5VGl0zPM/BcaFTVsBJLJt54ZZeYlIjOxoXSkBCzDqocQrR5C\nUN6x4WxMHGeZ8/fmnsZjsVBnottuv0VK06yvEKrwKJiXhgao4R2EOdZeg6uZ\nEMDIgwgPEb5SslKs4J/tCI/l7sXGEbA1/BOCq6miXVpDAyLNxciqBphT1SOn\nToxUvr7P0+D50ba72CIK7f2m9j85/sIsqFygT2J0i0ejQ68dkoddbERlCjfn\neX+29wPogyXugtMP76RIxJ5rEV2bUdX3Ia6rFTL27WNDElIGLL5cR92W5xK4\njy5Eqrc6GAkIxScoWrj0EOXFyCZz1awRc/XSNWoHq6Wkfpacxe+eiyAZw0ad\nah76\r\n=St8A\r\n-----END PGP SIGNATURE-----\r\n"},"main":"index.js","gitHead":"e9641a720b0e03a021d8cb457019a095083742f1","scripts":{"lint":"eslint .","test":"mocha"},"_npmUser":{"name":"ryanbrunner","email":"ryan@ryanbrunner.ca"},"pre-commit":["lint"],"repository":{"url":"git+ssh://git@github.com/mixmaxhq/cors-gate.git","type":"git"},"_npmVersion":"6.6.0","description":"Gate requests based on CORS data.","directories":{},"_nodeVersion":"8.9.3","_hasShrinkwrap":false,"devDependencies":{"cors":"^2.8.3","mocha":"^3.3.0","eslint":">=3","express":"^4.15.2","supertest":"^3.0.0","pre-commit":"^1.2.2","eslint-config-mixmax":"^0.6.0"},"_npmOperationalInternal":{"tmp":"tmp/cors-gate_1.1.3_1551922689463_0.45620800450678534","host":"s3://npm-registry-packages"}}},"time":{"created":"2017-05-11T23:13:41.812Z","modified":"2026-08-06T09:19:15.021Z","1.0.0":"2017-05-11T23:13:41.812Z","1.1.0":"2019-03-05T02:54:43.590Z","1.1.1":"2019-03-06T15:37:54.502Z","1.1.2":"2019-03-06T16:02:50.903Z","2.0.0":"2019-03-06T16:48:19.831Z","2.0.1":"2019-03-06T16:53:23.002Z","2.0.2":"2019-03-06T21:32:32.847Z","1.1.3":"2019-03-07T01:38:09.576Z"},"bugs":{"url":"https://github.com/mixmaxhq/cors-gate/issues"},"author":{"url":"https://mixmax.com","name":"Jeff Wear","email":"jeff@mixmax.com"},"license":"MIT","homepage":"https://github.com/mixmaxhq/cors-gate#readme","repository":{"url":"git+ssh://git@github.com/mixmaxhq/cors-gate.git","type":"git"},"description":"Gate requests based on CORS data.","contributors":[{"url":"https://mixmax.com","name":"Eli Skeggs","email":"eli@mixmax.com"}],"maintainers":[{"email":"mikusdominikcz@gmail.com","name":"mikusd"},{"email":"admin+mixmax-codeship-npm@mixmax.com","name":"mixmax-codeship"},{"email":"jesse@mixmax.com","name":"jessem3"},{"email":"syed.ahmed.anas@gmail.com","name":"ahmed-anas"},{"email":"guilhermem.j@hotmail.com","name":"guilhermemj"},{"email":"jordi.salvat.i.alabart@gmail.com","name":"jsalvata"},{"email":"raphael.b.souza@hotmail.com","name":"raphaelbs"},{"email":"it-ops@mixmax.com","name":"mixmax_it"},{"email":"akashbhalla@gmail.com","name":"akashbhalla"},{"email":"jordi.nistal@gmail.com","name":"jordins"},{"email":"amina@mixmax.com","name":"aminao"},{"email":"misterpy@gmail.com","name":"misterpy"},{"email":"pialwlc@gmail.com","name":"mvpia"},{"email":"nirmal@mixmax.com","name":"its-nimo"},{"email":"alexander.k@mixmax.com","name":"kohlhofer_mixmax"},{"email":"jakub@mixmax.com","name":"jtutaj"},{"email":"pedro@mixmax.com","name":"pedro-mixmax"},{"email":"alexander.simovic@gmail.com","name":"simalexan"},{"email":"graham@mixmax.com","name":"grahammixmax"},{"email":"jpdjeredjian@gmail.com","name":"jpdjere"},{"email":"skeggse@gmail.com","name":"skeggse"},{"email":"jeffreywear@gmail.com","name":"wearhere"}],"readme":"cors-gate\n=========\n\n[![Build Status](https://travis-ci.org/mixmaxhq/cors-gate.svg?branch=master)](https://travis-ci.org/mixmaxhq/cors-gate)\n\nConnect-compatible middleware to selectively reject requests based on CORS rules.\n\nThis lets you implement an elegant alternative to CSRF tokens if you only need to support\nmodern browsers. For more information, see [our blog post](https://mixmax.com/blog/modern-csrf).\n\nInstall\n-------\n\nRun this in your project:\n\n```sh\n$ npm install cors-gate\n```\n\nTest\n----\n\n```sh\n$ npm test\n```\n\nUsage\n-----\n\n```js\nconst express = require('express');\nconst cors = require('cors');\nconst corsGate = require('cors-gate');\n\nconst app = express();\n\napp.use(cors({\n  origin: ['https://app.mixmax.com', 'https://other-app.mixmax.com'],\n  credentials: true\n}));\n\n// prevent cross-origin requests from domains not permitted by the preceeding cors rules\napp.use(corsGate({\n  // require an Origin header, and reject request if missing\n  strict: true,\n  // permit GET and HEAD requests, even without an Origin header\n  allowSafe: true,\n  // the origin of the server\n  origin: 'https://api.mixmax.com'\n}));\n\n// add a new contact\napp.post('/api/contacts', function(req, res) {\n  // ...\n  res.status(200).json({id: id});\n});\n```\n\n### Alternative failure handling\n\nBy default, `cors-gate` will return `403 Unauthorized` to any requests that aren't permitted by the specified options.\n\nThe `failure` option offers a means to change this behavior. This way, unauthorized cross-origin requests can be permitted in a restricted manner - perhaps by requiring an explicit authentication mechanism rather than cookie-based authentication to prevent cross-site scripting. As such, `cors-gate` can serve as a CSRF mechanism without the need for a token, while still allowing limited forms of third-party cross-origin API requests.\n\n```js\napp.use(corsGate({\n  origin: 'https://api.mixmax.com',\n  failure: function(req, res, next) {\n    // requests from other origins will have this flag set.\n    req.requireExplicitAuthentication = true;\n    next();\n  }\n}));\n```\n\n### Firefox and the Origin header\n\nFirefox does not set the `Origin` header [on same-origin requests](http://stackoverflow.com/a/15514049/495611) (see also [csrf-request-tester](https://github.com/mixmaxhq/csrf-request-tester)) for same-origin requests, as of version 53. The `corsGate.originFallbackToReferrer` middleware will, if the `Origin` header is missing, fill it with the origin part of the `Referer`. This middleware thus enables verification of the `Origin` for same-origin requests.\n\nAdditionally, no browser sends the `Origin` header when sending a `GET` request to load an image. We could simply allow all `GET` requests - `GET` requests are safe, per `HTTP` - but we'd rather reject unauthorized cross-origin `GET` requests wholesale.\n\nAt present, Chrome and Safari do not support the `strict-origin` `Referrer-Policy`, so we can only patch the `Origin` from the `Referer` on Firefox. In patching it, however, we can reject unauthorized cross-origin `GET` requests from images, and once Chrome and Safari support `strict-origin`, we'll be able to do so on all three platforms.\n\nIn order to actually reject these requests, however, the patched `Origin` data must be visible to the `cors` middleware. This middleware is distinct because it must appear before `cors` and `corsGate` to perform all the described tasks.\n\n```js\napp.use(corsGate.originFallbackToReferrer());\napp.use(cors({ ... }));\napp.use(corsGate({ ... }));\n```\n\n### Language ports\n\n- Go: [Roemerb/corsgate](https://github.com/Roemerb/corsgate)\n\nLicense\n-------\n\nThe [MIT License](https://github.com/mixmaxhq/cors-gate/blob/master/LICENSE).\n","readmeFilename":"README.md","users":{"suddi":true}}