Skip to content

Commit 35fad5c

Browse files
vapiervapier
committed
add --coop option to enable cross-origin isolated
In order to utilize some web features like SharedArrayBuffer via localhost, COOP & COEP headers have to be set. Add an --coop option to let people easily opt-in to them. These are important for things like WebAssembly testing. More information can be found at: https://web.dev/cross-origin-isolation-guide/
1 parent 318c55f commit 35fad5c

File tree

9 files changed

+154
-0
lines changed

9 files changed

+154
-0
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ This will install `http-server` globally so that it may be run from the command
5252
|`-b` or `--brotli`|When enabled it will serve `./public/some-file.js.br` in place of `./public/some-file.js` when a brotli compressed version of the file exists and the request accepts `br` encoding. If gzip is also enabled, it will try to serve brotli first. |`false`|
5353
|`-e` or `--ext` |Default file extension if none supplied |`html` |
5454
|`-s` or `--silent` |Suppress log messages from output | |
55+
|`--coop` |Enable COOP via the `Cross-Origin-Opener-Policy` header | |
5556
|`--cors` |Enable CORS via the `Access-Control-Allow-Origin` header | |
5657
|`-o [path]` |Open browser window after starting the server. Optionally provide a URL path to open. e.g.: -o /other/dir/ | |
5758
|`-c` |Set cache time (in seconds) for cache-control max-age header, e.g. `-c10` for 10 seconds. To disable caching, use `-c-1`.|`3600` |
@@ -118,6 +119,7 @@ This is what should be output if successful:
118119
Starting up http-server, serving ./ through https
119120

120121
http-server settings:
122+
COOP: disabled
121123
CORS: disabled
122124
Cache: 3600 seconds
123125
Connection Timeout: 120 seconds

‎bin/http-server‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ if (argv.h || argv.help) {
3333
' If both brotli and gzip are enabled, brotli takes precedence',
3434
' -e --ext Default file extension if none supplied [none]',
3535
' -s --silent Suppress log messages from output',
36+
' --coop[=mode] Enable COOP via the "Cross-Origin-Opener-Policy" header',
37+
' Optionally provide COOP mode.',
3638
' --cors[=headers] Enable CORS via the "Access-Control-Allow-Origin" header',
3739
' Optionally provide CORS headers list separated by commas',
3840
' -o [path] Open browser window after starting the server.',
@@ -156,6 +158,13 @@ function listen(port) {
156158
password: argv.password || process.env.NODE_HTTP_SERVER_PASSWORD
157159
};
158160

161+
if (argv.coop) {
162+
options.coop = true;
163+
if (typeof argv.coop === 'string') {
164+
options.coopHeader = argv.coop;
165+
}
166+
}
167+
159168
if (argv.cors) {
160169
options.cors = true;
161170
if (typeof argv.cors === 'string') {
@@ -209,6 +218,7 @@ function listen(port) {
209218

210219
logger.info([
211220
chalk.yellow('\nhttp-server settings: '),
221+
([chalk.yellow('COOP: '), argv.coop ? chalk.cyan(argv.coop) : chalk.red('disabled')].join('')),
212222
([chalk.yellow('CORS: '), argv.cors ? chalk.cyan(argv.cors) : chalk.red('disabled')].join('')),
213223
([chalk.yellow('Cache: '), argv.c ? (argv.c === '-1' ? chalk.red('disabled') : chalk.cyan(argv.c + ' seconds')) : chalk.cyan('3600 seconds')].join('')),
214224
([chalk.yellow('Connection Timeout: '), argv.t === '0' ? chalk.red('disabled') : (argv.t ? chalk.cyan(argv.t + ' seconds') : chalk.cyan('120 seconds'))].join('')),

‎doc/http-server.1‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,12 @@ Default file extension is none is provided.
5757
.BI \-s ", " \-\-silent
5858
Suppress log messages from output.
5959

60+
.TP
61+
.BI \-\-coop " " [\fIMODE\fR]
62+
Enable COOP via the "Cross-Origin-Opener-Policy" header and sets
63+
the "Cross-Origin-Embedder-Policy" header to "require-corp".
64+
Optionally provide COOP mode which defaults to "same-origin".
65+
6066
.TP
6167
.BI \-\-cors " " [\fIHEADERS\fR]
6268
Enable CORS via the "Access-Control-Allow-Origin" header.

‎lib/core/aliases.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
"hidePermissions": ["hidePermissions", "hidepermissions", "hide-permissions"],
77
"si": [ "si", "index" ],
88
"handleError": [ "handleError", "handleerror" ],
9+
"coop": [ "coop", "COOP" ],
910
"cors": [ "cors", "CORS" ],
1011
"headers": [ "H", "header", "headers" ],
1112
"contentType": [ "contentType", "contenttype", "content-type" ],

‎lib/core/defaults.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
"hidePermissions": false,
77
"si": false,
88
"cache": "max-age=3600",
9+
"coop": false,
910
"cors": false,
1011
"gzip": true,
1112
"brotli": false,

‎lib/core/opts.js‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,14 @@ module.exports = (opts) => {
117117
return false;
118118
});
119119

120+
aliases.coop.forEach((k) => {
121+
if (isDeclared(k) && opts[k]) {
122+
handleOptionsMethod = true;
123+
headers['Cross-Origin-Opener-Policy'] = 'same-origin';
124+
headers['Cross-Origin-Embedder-Policy'] = 'require-corp';
125+
}
126+
});
127+
120128
aliases.cors.forEach((k) => {
121129
if (isDeclared(k) && opts[k]) {
122130
handleOptionsMethod = true;

‎lib/http-server.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,11 @@ function HttpServer(options) {
9898
});
9999
}
100100

101+
if (options.coop) {
102+
this.headers['Cross-Origin-Opener-Policy'] = options.coopHeader || 'same-origin';
103+
this.headers['Cross-Origin-Embedder-Policy'] = 'require-corp';
104+
}
105+
101106
if (options.cors) {
102107
this.headers['Access-Control-Allow-Origin'] = '*';
103108
this.headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Range';

‎test/coop.test.js‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
'use strict';
2+
3+
const test = require('tap').test;
4+
const server = require('../lib/core');
5+
const http = require('http');
6+
const path = require('path');
7+
const request = require('request');
8+
9+
const root = path.join(__dirname, 'public');
10+
11+
test('coop defaults to false', (t) => {
12+
t.plan(4);
13+
14+
const httpServer = http.createServer(
15+
server({
16+
root,
17+
autoIndex: true,
18+
defaultExt: 'html',
19+
})
20+
);
21+
22+
httpServer.listen(() => {
23+
const port = httpServer.address().port;
24+
const uri = `http://localhost:${port}/subdir/index.html`;
25+
26+
request.get({ uri }, (err, res) => {
27+
t.ifError(err);
28+
t.equal(res.statusCode, 200);
29+
t.type(res.headers['cross-origin-opener-policy'], 'undefined');
30+
t.type(res.headers['cross-origin-embedder-policy'], 'undefined');
31+
});
32+
});
33+
t.once('end', () => {
34+
httpServer.close();
35+
});
36+
});
37+
38+
test('coop set to false', (t) => {
39+
t.plan(4);
40+
41+
const httpServer = http.createServer(
42+
server({
43+
root,
44+
coop: false,
45+
autoIndex: true,
46+
defaultExt: 'html',
47+
})
48+
);
49+
50+
httpServer.listen(() => {
51+
const port = httpServer.address().port;
52+
const uri = `http://localhost:${port}/subdir/index.html`;
53+
54+
request.get({ uri }, (err, res) => {
55+
t.ifError(err);
56+
t.equal(res.statusCode, 200);
57+
t.type(res.headers['cross-origin-opener-policy'], 'undefined');
58+
t.type(res.headers['cross-origin-embedder-policy'], 'undefined');
59+
});
60+
});
61+
t.once('end', () => {
62+
httpServer.close();
63+
});
64+
});
65+
66+
test('coop set to true', (t) => {
67+
t.plan(4);
68+
69+
const httpServer = http.createServer(
70+
server({
71+
root,
72+
coop: true,
73+
autoIndex: true,
74+
defaultExt: 'html',
75+
})
76+
);
77+
78+
httpServer.listen(() => {
79+
const port = httpServer.address().port;
80+
const uri = `http://localhost:${port}/subdir/index.html`;
81+
request.get({ uri }, (err, res) => {
82+
t.ifError(err);
83+
t.equal(res.statusCode, 200);
84+
t.equal(res.headers['cross-origin-opener-policy'], 'same-origin');
85+
t.equal(res.headers['cross-origin-embedder-policy'], 'require-corp');
86+
});
87+
});
88+
t.once('end', () => {
89+
httpServer.close();
90+
});
91+
});
92+
93+
test('COOP set to true', (t) => {
94+
t.plan(4);
95+
96+
const httpServer = http.createServer(
97+
server({
98+
root,
99+
COOP: true,
100+
autoIndex: true,
101+
defaultExt: 'html',
102+
})
103+
);
104+
105+
httpServer.listen(() => {
106+
const port = httpServer.address().port;
107+
const uri = `http://localhost:${port}/subdir/index.html`;
108+
request.get({ uri }, (err, res) => {
109+
t.ifError(err);
110+
t.equal(res.statusCode, 200);
111+
t.equal(res.headers['cross-origin-opener-policy'], 'same-origin');
112+
t.equal(res.headers['cross-origin-embedder-policy'], 'require-corp');
113+
});
114+
});
115+
t.once('end', () => {
116+
httpServer.close();
117+
});
118+
});

‎test/main.test.js‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ test('http-server main', (t) => {
2626
'Access-Control-Allow-Origin': '*',
2727
'Access-Control-Allow-Credentials': 'true'
2828
},
29+
coop: true,
2930
cors: true,
3031
corsHeaders: 'X-Test',
3132
ext: true,
@@ -63,6 +64,8 @@ test('http-server main', (t) => {
6364
// Custom headers
6465
t.equal(res.headers['access-control-allow-origin'], '*');
6566
t.equal(res.headers['access-control-allow-credentials'], 'true');
67+
t.equal(res.headers['cross-origin-opener-policy'], 'same-origin');
68+
t.equal(res.headers['cross-origin-embedder-policy'], 'require-corp');
6669
}).catch(err => t.fail(err.toString())),
6770

6871
// Get robots

0 commit comments

Comments
 (0)