detailyang/lua-resty-cors

It's the implement of CORS on OpenResty

Name

lua-resty-cors

lua-resty-cors

It's the implement of CORS on OpenResty and It backports the nginx-http-cors to OpenResty

Table of Contents

• Name
• Status
• Usage
• API
• Contributing
• Author
• License

Status

Usage

It may be placed on the nginx http block for a global CORS config or in each server block to configure a different CORS for each virtual host as the following:

http {
      init_by_lua_block {
        local cors = require('lib.resty.cors');

        cors.allow_host([==[.*\.google\.com]==])
        cors.allow_host([==[.*\.facebook\.com]==])
        cors.expose_header('x-custom-field1')
        cors.expose_header('x-custom-field2')
        cors.allow_method('GET')
        cors.allow_method('POST')
        cors.allow_method('PUT')
        cors.allow_method('DELETE')
        cors.allow_header('x-custom-field1')
        cors.allow_header('x-custom-field2')
        cors.max_age(7200)
        cors.allow_credentials(false)
      }
      
      header_filter_by_lua_block {
        local cors = require('lib.resty.cors');
        cors.run()
    }
}

API

allow_host

syntax: cors.allow_host(host)

This will match the host from cors request then be added to the header Access-Control-Allow-Origin like as the following:

Request:
Origin: https://www.google.com

Response:
Access-Control-Allow-Origin: http://www.google.com

expose_header

syntax: cors.expose_header(header)

This will be added to the header Access-Control-Expose-Headers like as the following:

Request:
Origin: https://www.google.com

Response:
Access-Control-Expose-Headers: x-custom-field1,x-custom-field2

allow_method

syntax: cors.allow_method(method)

This will be added to the header Access-Control-Allow-Methods like as the following:

Request:
Origin: https://www.google.com

Response:
Access-Control-Allow-Methods:GET,POST,PUT

allow_header

syntax: cors.allow_header(header)

This will be added to the header Access-Control-Allow-Headers like as the following:

Request:
Origin: https://www.google.com

Response:
Access-Control-Allow-Headers:x-custom-field1,x-custom-field2

max_age

syntax: cors.max_age(age)

This will be added to the header Access-Control-Max-Age like as the following:

Request:
Origin: https://www.google.com

Response:
Access-Control-Max-Age: 7200

Allow-Credentials

syntax: cors.allow_credentials(true or false)

This will be added to the header Access-Control-Allow-Credentials like as the following:

Request:
Origin: https://www.google.com

Response:
Access-Control-Allow-Credentials: true

run

syntax: cors.run()

This is the entry for lua-resty-cors to run

Contributing

To contribute to lua-resty-cors, clone this repo locally and commit your code on a separate branch.

PS: PR Welcome 🚀 🚀 🚀 🚀

Author

GitHub @detailyang

License

lua-resty-cors is licensed under the MIT license.

lua-resty-cors's Issues

local variables are not cleanup

Hi

I tried to setup this module and noticed that while with few requests it looks that it works, with many we start to get duplicated headers and the server load keeps increasing

Adding a debug line like the one below

     for k, v in pairs(allow_hosts) do
         local from, to, err = ngx.re.find(origin, v, "jo")
+        ngx.log(ngx.ERR, "cors.re: " .. #allow_hosts )
         if from then
             matched = true

i get this result:

2018/10/22 21:15:32 [error] 24637#24637: *520 [lua] cors.lua:81: run(): cors.re: 6 while reading response header from upstream, client: 127.0.0.1, server: site-staging.example.com, request: "HEAD / HTTP/1.1", upstream: "http://127.0.0.1:2081/", host: "site-staging.example.com"
2018/10/22 21:15:32 [error] 24637#24637: *520 [lua] cors.lua:81: run(): cors.re: 6 while reading response header from upstream, client: 127.0.0.1, server: site-staging.example.com, request: "HEAD / HTTP/1.1", upstream: "http://127.0.0.1:2081/", host: "site-staging.example.com"
2018/10/22 21:15:32 [error] 24637#24637: *520 [lua] cors.lua:81: run(): cors.re: 6 while reading response header from upstream, client: 127.0.0.1, server: site-staging.example.com, request: "HEAD / HTTP/1.1", upstream: "http://127.0.0.1:2081/", host: "site-staging.example.com"
2018/10/22 21:15:32 [error] 24637#24637: *520 [lua] cors.lua:81: run(): cors.re: 6 while reading response header from upstream, client: 127.0.0.1, server: site-staging.example.com, request: "HEAD / HTTP/1.1", upstream: "http://127.0.0.1:2081/", host: "site-staging.example.com"
2018/10/22 21:15:32 [error] 24637#24637: *132 [lua] cors.lua:81: run(): cors.re: 3 while reading response header from upstream, client: 127.0.0.1, server: site-staging.example.com, request: "HEAD / HTTP/1.1", upstream: "http://127.0.0.1:2081/", host: "site-staging.example.com"
2018/10/22 21:15:32 [error] 24637#24637: *132 [lua] cors.lua:81: run(): cors.re: 3 while reading response header from upstream, client: 127.0.0.1, server: site-staging.example.com, request: "HEAD / HTTP/1.1", upstream: "http://127.0.0.1:2081/", host: "site-staging.example.com"
2018/10/22 21:15:32 [error] 24637#24637: *132 [lua] cors.lua:81: run(): cors.re: 3 while reading response header from upstream, client: 127.0.0.1, server: site-staging.example.com, request: "HEAD / HTTP/1.1", upstream: "http://127.0.0.1:2081/", host: "site-staging.example.com"
2018/10/22 21:15:32 [error] 24638#24638: *86 [lua] cors.lua:81: run(): cors.re: 9 while reading response header from upstream, client: 127.0.0.1, server: site-staging.example.com, request: "HEAD / HTTP/1.1", upstream: "http://127.0.0.1:2081/", host: "site-staging.example.com"
2018/10/22 21:15:32 [error] 24638#24638: *86 [lua] cors.lua:81: run(): cors.re: 9 while reading response header from upstream, client: 127.0.0.1, server: site-staging.example.com, request: "HEAD / HTTP/1.1", upstream: "http://127.0.0.1:2081/", host: "site-staging.example.com"
2018/10/22 21:15:32 [error] 24638#24638: *86 [lua] cors.lua:81: run(): cors.re: 9 while reading response header from upstream, client: 127.0.0.1, server: site-staging.example.com, request: "HEAD / HTTP/1.1", upstream: "http://127.0.0.1:2081/", host: "site-staging.example.com"

the allow_host jumps from 3 (the real number of allow_host configs i have) to 6, 9, 12, etc and then randomly resets back to 3

Looks like that the variable sometimes is global, other times local

I tried to add this between the for and the if check:

+    -- cleanup variables so they do not grow on next request
+    allow_hosts = {}
     if matched == false then

and it do help, makes it less common, but still get some higher count than 3 in the allow_host

So any idea what is going on?

i'm using nginx 1.14.0 and libluajit-5.1-2 on a ubuntu xenial

Installation

I installed the module but it seems to still not work:

sudo opm install detailyang/lua-resty-cors
Package lua-resty-cors-0.2.1.5 already installed.

Error:

failed to run header_filter_by_lua*: header_filter_by_lua:2: module 'lib.resty.cors' not found:
        no field package.preload['lib.resty.cors']
        no file '/usr/local/openresty/site/lualib/lib/resty/cors.ljbc'
        no file '/usr/local/openresty/site/lualib/lib/resty/cors/init.ljbc'
        no file '/usr/local/openresty/lualib/lib/resty/cors.ljbc'
        no file '/usr/local/openresty/lualib/lib/resty/cors/init.ljbc'
        no file '/usr/local/openresty/site/lualib/lib/resty/cors.lua'
        no file '/usr/local/openresty/site/lualib/lib/resty/cors/init.lua'
        no file '/usr/local/openresty/lualib/lib/resty/cors.lua'
        no file '/usr/local/openresty/lualib/lib/resty/cors/init.lua'
        no file './lib/resty/cors.lua'
        no file '/usr/local/openresty/luajit/share/luajit-2.1.0-beta3/lib/resty/cors.lua'
        no file '/usr/local/share/lua/5.1/lib/resty/cors.lua'
        no file '/usr/local/share/lua/5.1/lib/resty/cors/init.lua'
        no file '/usr/local/openresty/luajit/share/lua/5.1/lib/resty/cors.lua'
        no file '/usr/local/openresty/luajit/share/lua/5.1/lib/resty/cors/init.lua'
        no file '/usr/local/openresty/site/lualib/lib/resty/cors.so'
        no file '/usr/local/openresty/lualib/lib/resty/cors.so'
        no file './lib/resty/cors.so'
        no file '/usr/local/lib/lua/5.1/lib/resty/cors.so'
        no file '/usr/local/openresty/luajit/lib/lua/5.1/lib/resty/cors.so'
        no file '/usr/local/lib/lua/5.1/loadall.so'
        no file '/usr/local/openresty/site/lualib/lib.so'
        no file '/usr/local/openresty/lualib/lib.so'
        no file './lib.so'
        no file '/usr/local/lib/lua/5.1/lib.so'
        no file '/usr/local/openresty/luajit/lib/lua/5.1/lib.so'
        no file '/usr/local/lib/lua/5.1/loadall.so'

LuaRocks

Hi. Have you deployed this to LuaRocks so it can be added easily to OpenResty?

Update your packeage on OPM

I noticed your packaged version on OPM and the release on GH are quite a out of date with each other (OPM gets version 0.1.0 Github has 0.2.1) Also could you do a new realese with the new code in it?

see Pull request #3 for changes proposed.

minor documentation update

Sorry to nag you again! 😄

Just to remind you to update the readme, to change:

It shoule be placed on the nginx init phase and run at header phase as the following:

To something like

It may be placed on the nginx http block for a global CORS config or in each server block to configure a different CORS for each virtual host as the following:

And, in the example, put everything back in the header_filter_by_lua_block. Or give 2 examples, one in the http with init and header_filter and another with server block with everything in the header_filter

Many thanks for this module and for the help!

upload new version to luarocks

hi, we switched to opm but might still be good to have the newest version of this on luarocks

add small optimization

Please add this small optimization, if it match already, no need to keep checking other allow_host. This may save many CPU cycles in a request heavy server when several allow_hosts are used

Around line 82:

if from then
            matched = true
+          break
end

Thanks! :)