refactor: default clientBasedCORS helper is now false

BREAKING CHANGE: Default clientBasedCORS helper return value is now `false`, you must ergo use this helper to open up cors based on your policy.
panva · Mar 17, 2020 · 4cf4cc6 · 4cf4cc6
1 parent 4df1a0c
commit 4cf4cc6
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 15 deletions.
diff --git a/docs/README.md b/docs/README.md
@@ -1980,7 +1980,7 @@ Function used to check whether a given CORS request should be allowed based on t
 _**default value**_:
 ```js
 function clientBasedCORS(ctx, origin, client) {
-  return true;
+  return false;
 }
 ```
 

diff --git a/lib/helpers/defaults.js b/lib/helpers/defaults.js
@@ -36,8 +36,8 @@ async function audiences(ctx, sub, token, use) { // eslint-disable-line no-unuse
 }
 
 function clientBasedCORS(ctx, origin, client) { // eslint-disable-line no-unused-vars
-  shouldChange('clientBasedCORS', 'control CORS allowed Origins based on the client making a CORS request');
-  return true;
+  mustChange('clientBasedCORS', 'control CORS allowed Origins based on the client making a CORS request');
+  return false;
 }
 
 /* istanbul ignore next */

diff --git a/test/cors/cors.test.js b/test/cors/cors.test.js
@@ -103,7 +103,18 @@ describe('CORS setup', () => {
     expect(headers[ACAHeaders]).to.eql('foo');
   });
 
-  describe('with clientBasedCORS true (default)', () => {
+  describe('with clientBasedCORS resolving to true', () => {
+    before(function () {
+      const conf = i(this.provider).configuration();
+      this.clientBasedCORS = conf.clientBasedCORS;
+      conf.clientBasedCORS = () => true;
+    });
+
+    after(function () {
+      const conf = i(this.provider).configuration();
+      conf.clientBasedCORS = this.clientBasedCORS;
+    });
+
     it('userinfo has cors open', async function () {
       const { status, headers } = await req.call(
         this,
@@ -281,17 +292,7 @@ describe('CORS setup', () => {
     });
   });
 
-  describe('with clientBasedCORS false', () => {
-    before(function () {
-      const conf = i(this.provider).configuration();
-      conf.clientBasedCORS = () => false;
-    });
-
-    after(function () {
-      const conf = i(this.provider).configuration();
-      conf.clientBasedCORS = () => true;
-    });
-
+  describe('with clientBasedCORS false (default)', () => {
     it('userinfo has cors closed', async function () {
       const { status, headers } = await req.call(
         this,