docs: add cors config

License: MIT
Signed-off-by: Henrique Dias <[email protected]>

README.md

@@ -26,6 +26,11 @@ scope: .
 modify: true
 rules: []
 
+# CORS configuration
+cors:
+  - enabled: false
+    allowed_hosts: []
+
 users:
   - username: admin
     password: admin

cmd/cmd.go

@@ -9,4 +9,4 @@ func Execute() {
 	if err := rootCmd.Execute(); err != nil {
 		log.Fatal(err)
 	}
-}
+}

cmd/config.go

@@ -118,6 +118,32 @@ func parseUsers(raw []interface{}, c *webdav.Config) {
 	}
 }
 
+func parseCors(raw []interface{}, c *webdav.Config) {
+	hosts := []string{}
+
+	for _, v := range raw {
+
+		if cfg, ok := v.(map[interface{}]interface{}); ok {
+
+			cors := webdav.CorsCfg{
+				Enabled:      cfg["enabled"].(bool),
+				AllowedHosts: []string{},
+			}
+
+			if allowedHosts, ok := cfg["allowed_hosts"]; ok {
+				hosts = append(hosts, strings.Split(allowedHosts.(string), ",")...)
+			}
+
+			if len(hosts) == 0 {
+				hosts = append(hosts, "*")
+			}
+
+			cors.AllowedHosts = hosts
+			c.Cors = cors
+		}
+	}
+}
+
 func readConfig(flags *pflag.FlagSet) *webdav.Config {
 	cfg := &webdav.Config{
 		User: &webdav.User{
@@ -129,7 +155,11 @@ func readConfig(flags *pflag.FlagSet) *webdav.Config {
 				LockSystem: wd.NewMemLS(),
 			},
 		},
-		Auth:  getOptB(flags, "auth"),
+		Auth: getOptB(flags, "auth"),
+		Cors: webdav.CorsCfg{
+			Enabled:      false,
+			AllowedHosts: []string{},
+		},
 		Users: map[string]*webdav.User{},
 	}
 
@@ -143,6 +173,11 @@ func readConfig(flags *pflag.FlagSet) *webdav.Config {
 		parseUsers(users, cfg)
 	}
 
+	rawCors := v.Get("cors")
+	if cors, ok := rawCors.([]interface{}); ok {
+		parseCors(cors, cfg)
+	}
+
 	if len(cfg.Users) != 0 && !cfg.Auth {
 		log.Print("Users will be ignored due to auth=false")
 	}

webdav/utils.go

@@ -14,3 +14,12 @@ func checkPassword(saved, input string) bool {
 
 	return saved == input
 }
+
+func isAllowedHost(allowedHosts []string, origin string) bool {
+	for _, host := range allowedHosts {
+		if host == origin {
+			return true
+		}
+	}
+	return false
+}

webdav/webdav.go

@@ -6,16 +6,44 @@ import (
 	"net/http"
 )
 
+// CorsCfg is the CORS config.
+type CorsCfg struct {
+	Enabled      bool
+	AllowedHosts []string
+}
+
 // Config is the configuration of a WebDAV instance.
 type Config struct {
 	*User
 	Auth  bool
+	Cors  CorsCfg
 	Users map[string]*User
 }
 
 // ServeHTTP determines if the request is for this plugin, and if all prerequisites are met.
 func (c *Config) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	u := c.User
+	requestOrigin := r.Header.Get("Origin")
+
+	// add cors headers before any operation so even on 401 unauthorized cors will working only when Origin header is present so request came from browser
+	if c.Cors.Enabled && requestOrigin != "" {
+
+		headers := w.Header()
+
+		if len(c.Cors.AllowedHosts) == 1 && c.Cors.AllowedHosts[0] == "*" {
+			headers.Set("Access-Control-Allow-Methods", "*")
+			headers.Set("Access-Control-Allow-Headers", "*")
+			headers.Set("Access-Control-Allow-Origin", "*")
+		} else if isAllowedHost(c.Cors.AllowedHosts, requestOrigin) {
+			headers.Set("Access-Control-Allow-Origin", requestOrigin)
+			headers.Set("Access-Control-Allow-Headers", "*")
+			headers.Set("Access-Control-Allow-Methods", "*")
+		}
+	}
+
+	if r.Method == "OPTIONS" && c.Cors.Enabled && requestOrigin != "" {
+		return
+	}
 
 	if c.Auth {
 		w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
@@ -40,6 +68,16 @@ func (c *Config) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		}
 
 		u = user
+	} else {
+		// Even if Auth is disabled, we might want to get
+		// the user from the Basic Auth header. Useful for Caddy
+		// plugin implementation.
+		username, _, ok := r.BasicAuth()
+		if ok {
+			if user, ok := c.Users[username]; ok {
+				u = user
+			}
+		}
 	}
 
 	// Checks for user permissions relatively to this PATH.