Skip to content
/ jsonp Public

jsonp support for egg, with security check inside

License

Notifications You must be signed in to change notification settings

eggjs/jsonp

Repository files navigation

@eggjs/jsonp

NPM version Node.js CI Test coverage Known Vulnerabilities npm download Node.js Version PRs Welcome

An egg plugin for jsonp support.

Requirements

  • egg >= 4.x

Install

npm i @eggjs/jsonp

Usage

// {app_root}/config/plugin.ts

export default {
  jsonp: {
    enable: true,
    package: '@eggjs/jsonp',
  },
};

Configuration

  • {String|Array} callback - jsonp callback method key, default to [ '_callback', 'callback' ]
  • {Number} limit - callback method name's max length, default to 50
  • {Boolean} csrf - enable csrf check or not. default to false
  • {String|RegExp|Array} whiteList - referrer white list

if whiteList's type is RegExp, referrer must match whiteList, pay attention to the first ^ and last /.

export default {
  jsonp: {
    whiteList: /^https?:\/\/test.com\//,
  },
};

// matchs referrer:
// https://test.com/hello
// http://test.com/

if whiteList's type is String and starts with .:

export default {
  jsonp: {
    whiteList: '.test.com',
  },
};

// matchs domain test.com:
// https://test.com/hello
// http://test.com/

// matchs subdomain
// https://sub.test.com/hello
// http://sub.sub.test.com/

if whiteList's type is String and not starts with .:

export default {
  jsonp: {
    whiteList: 'sub.test.com',
  },
};

// only matchs domain sub.test.com:
// https://sub.test.com/hello
// http://sub.test.com/

whiteList also can be an array:

export default {
  jsonp: {
    whiteList: [ '.foo.com', '.bar.com' ],
  },
};

see config/config.default.ts for more detail.

API

  • ctx.acceptJSONP - detect if response should be jsonp, readonly

Example

In app/router.ts

// Create once and use in any router you want to support jsonp.
const jsonp = app.jsonp();

app.get('/default', jsonp, 'jsonp.index');
app.get('/another', jsonp, 'jsonp.another');

// Customize by create another jsonp middleware with specific configurations.
app.get('/customize', app.jsonp({ callback: 'fn' }), 'jsonp.customize');

Questions & Suggestions

Please open an issue here.

License

MIT

Contributors

Contributors

Made with contributors-img.