如何使用基于网站的 ExpressJs 设置 CORS 和 JWT 令牌验证

Question

So basically, I have two websites with different subdomain. The first one doesn't need JWT Token validation but the second needs validation.

How to use the app.use(authorization) only when the origin is https://app.website.com ?

import cors from 'cors';

if (process.env.NODE_ENV === 'development') {
  app.use(cors());
} else {
  const whitelist = ['https://www.website.com', 'https://app.website.com'];
  app.use(
    cors({
      origin: function (origin, callback) {
        if (origin && whitelist.indexOf(origin) !== -1) {
          return callback(null, true);
        }
        return callback(new Error('Forbidden'), false); 
      },
      optionsSuccessStatus: 204
    })
  );
  app.use(authorization);
}

JWT validation as a middleware, I tried to check req.get('origin') but it's undefined..

import admin from '../helpers/firebase.helper';

const authorization = async (
  req,
  res,
  next
): Promise<void> => {
  if (req.headers?.authorization?.startsWith('Bearer ')) {
       const idToken = req.headers.authorization.split('Bearer ')[1];
    try {
      const decodeToken = await admin.auth().verifyIdToken(idToken);
      req.current = decodeToken;
      next();
    } catch (err) {
      res.status(StatusCodes.UNAUTHORIZED).send('UnAuthorized');
    }
  } else {
    res.status(StatusCodes.UNAUTHORIZED).send('UnAuthorized');
  }
};

The first site www.welcome.com is built with Nextjs (server side rendering) and the second one with React create app (client side rendering). So when I check req.get('origin') for react create app request it's working fine, but for the request which comes from the nextjs app it's undefined.

Diagram

Answer 1

You should be able to use req.hostname to get the host on which you received the request. You can check other properties of the request object in the docs: http://expressjs.com/en/api.html#req

Answer 2

Finally, I solved the problem. The problem was with NextJs, I was doing a server side request with getserversideprops (no CORS when server to server), so I move to a basic client request, then it's works fine. I have access to req.origin so I can check the origin.