torsten/harheimertc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor CORS header handling in authentication endpoints
Some checks failed
Code Analysis (JS/Vue) / analyze (push) Failing after 50s
Details

Browse Source 
Update the CORS header variable name from 'origin' to 'requestOrigin' in both login and registration API endpoints for improved clarity and consistency. This change enhances the readability of the code while maintaining support for cross-device authentication.
This commit is contained in:
Torsten Schulz (local)
2026-01-07 21:02:58 +01:00
parent ad21534862
commit e7e9d7815c
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
server/api/auth/passkeys/login.post.js
View File

@@ -19,9 +19,9 @@ function findUserByCredentialId(users, credentialId) {
export default defineEventHandler(async (event) => { export default defineEventHandler(async (event) => {
// CORS-Header für Cross-Device Authentication // CORS-Header für Cross-Device Authentication
const origin = getHeader(event, 'origin') const requestOrigin = getHeader(event, 'origin')
if (origin) { if (requestOrigin) {
setHeader(event, 'Access-Control-Allow-Origin', origin) setHeader(event, 'Access-Control-Allow-Origin', requestOrigin)
setHeader(event, 'Access-Control-Allow-Credentials', 'true') setHeader(event, 'Access-Control-Allow-Credentials', 'true')
setHeader(event, 'Access-Control-Allow-Methods', 'POST, OPTIONS') setHeader(event, 'Access-Control-Allow-Methods', 'POST, OPTIONS')
setHeader(event, 'Access-Control-Allow-Headers', 'Content-Type, Authorization') setHeader(event, 'Access-Control-Allow-Headers', 'Content-Type, Authorization')

6
server/api/auth/passkeys/register.post.js
View File

@@ -7,9 +7,9 @@ import { writeAuditLog } from '../../../utils/audit-log.js'
export default defineEventHandler(async (event) => { export default defineEventHandler(async (event) => {
// CORS-Header für Cross-Device Authentication // CORS-Header für Cross-Device Authentication
const origin = getHeader(event, 'origin') const requestOrigin = getHeader(event, 'origin')
if (origin) { if (requestOrigin) {
setHeader(event, 'Access-Control-Allow-Origin', origin) setHeader(event, 'Access-Control-Allow-Origin', requestOrigin)
setHeader(event, 'Access-Control-Allow-Credentials', 'true') setHeader(event, 'Access-Control-Allow-Credentials', 'true')
setHeader(event, 'Access-Control-Allow-Methods', 'POST, OPTIONS') setHeader(event, 'Access-Control-Allow-Methods', 'POST, OPTIONS')
setHeader(event, 'Access-Control-Allow-Headers', 'Content-Type, Authorization') setHeader(event, 'Access-Control-Allow-Headers', 'Content-Type, Authorization')