Merge pull request #2859 from AdriVanHoudt/cors-404-reasons

Add error messages to 404's caused by cors closes #2857
hapijs · Oct 20, 2015 · 2018ff8 · 2018ff8
2 parents 7037f5f + 0f06182
commit 2018ff8
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 5 deletions.
diff --git a/lib/cors.js b/lib/cors.js
@@ -87,12 +87,12 @@ internals.handler = function (request, reply) {
 
     var origin = request.headers.origin;
     if (!origin) {
-        return reply(Boom.notFound());
+        return reply(Boom.notFound('Missing Origin header'));
     }
 
     var method = request.headers['access-control-request-method'];
     if (!method) {
-        return reply(Boom.notFound());
+        return reply(Boom.notFound('Missing Access-Control-Request-Method header'));
     }
 
     // Lookup route
@@ -104,13 +104,13 @@ internals.handler = function (request, reply) {
 
     var settings = route.settings.cors;
     if (!settings) {
-        return reply(Boom.notFound());
+        return reply(Boom.notFound('CORS is disabled for this route'));
     }
 
     // Validate Origin header
 
     if (!internals.matchOrigin(origin, settings)) {
-        return reply(Boom.notFound());
+        return reply(Boom.notFound('Origin not allowed'));
     }
 
     // Validate allowed headers
@@ -119,7 +119,7 @@ internals.handler = function (request, reply) {
     if (headers) {
         headers = headers.split(/\s*,\s*/);
         if (Hoek.intersect(headers, settings._headers).length !== headers.length) {
-            return reply(Boom.notFound());
+            return reply(Boom.notFound('Some headers are not allowed'));
         }
     }
 

diff --git a/test/cors.js b/test/cors.js
@@ -96,6 +96,7 @@ describe('CORS', function () {
             server.inject({ method: 'OPTIONS', url: '/b', headers: { origin: 'http://example.com/', 'access-control-request-method': 'GET' } }, function (res2) {
 
                 expect(res2.statusCode).to.equal(404);
+                expect(res2.result.message).to.equal('CORS is disabled for this route');
                 expect(res2.headers['access-control-allow-origin']).to.not.exist();
                 done();
             });
@@ -130,6 +131,7 @@ describe('CORS', function () {
                 server.inject({ method: 'OPTIONS', url: '/c', headers: { origin: 'http://example.com/', 'access-control-request-method': 'GET' } }, function (res3) {
 
                     expect(res3.statusCode).to.equal(404);
+                    expect(res3.result.message).to.equal('CORS is disabled for this route');
                     expect(res3.headers['access-control-allow-origin']).to.not.exist();
                     done();
                 });
@@ -455,6 +457,7 @@ describe('CORS', function () {
             server.inject({ method: 'OPTIONS', url: '/', headers: { 'access-control-request-method': 'GET' } }, function (res) {
 
                 expect(res.statusCode).to.equal(404);
+                expect(res.result.message).to.equal('Missing Origin header');
                 done();
             });
         });
@@ -472,6 +475,7 @@ describe('CORS', function () {
             server.inject({ method: 'OPTIONS', url: '/', headers: { origin: 'http://example.com/' } }, function (res) {
 
                 expect(res.statusCode).to.equal(404);
+                expect(res.result.message).to.equal('Missing Access-Control-Request-Method header');
                 done();
             });
         });
@@ -501,6 +505,7 @@ describe('CORS', function () {
             server.inject({ method: 'OPTIONS', url: '/', headers: { origin: 'http://example.com/', 'access-control-request-method': 'GET' } }, function (res) {
 
                 expect(res.statusCode).to.equal(404);
+                expect(res.result.message).to.equal('Origin not allowed');
                 done();
             });
         });
@@ -554,6 +559,7 @@ describe('CORS', function () {
             }, function (res) {
 
                 expect(res.statusCode).to.equal(404);
+                expect(res.result.message).to.equal('Some headers are not allowed');
                 done();
             });
         });