Add support for Private Network Access via Access-Control-Allow-Private-Network header (#801)

This PR has stale tests for an older version of tap so a subsequent fix is required for the tests.

Co-authored-by: Eric Dubé <[email protected]>

Author: artemdanylenko

README.md

@@ -72,6 +72,7 @@ with the provided Dockerfile.
 |`-s` or `--silent` |Suppress log messages from output  | |
 |`--coop` |Enable COOP via the `Cross-Origin-Opener-Policy` header  | |
 |`--cors` |Enable CORS via the `Access-Control-Allow-Origin` header  | |
+|`--private-network-access` |Enable Private Network Access via the `Access-Control-Allow-Private-Network` header  | |
 |`--cors` | Enable CORS via the `Access-Control-Allow-Origin: *` header. Optionally provide comma-separated values to add to `Access-Control-Allow-Headers`  | |
 |`-H` or `--header` |Add an extra response header (can be used several times)  | |
 |`-o [path]` |Open browser window after starting the server. Optionally provide a URL path to open. e.g.: -o /other/dir/ | |

bin/http-server

@@ -50,6 +50,9 @@ if (argv.h || argv.help) {
     '                  Optionally provide COOP mode.',
     '  --content-type     Default content type for unknown file types [application/octet-stream]',
     '  --cors[=headers]   Enable CORS via the "Access-Control-Allow-Origin" header',
+    '                     Optionally provide CORS headers list separated by commas',
+    '  --private-network-access Enable Private Network Access via the',
+    '                           "Access-Control-Allow-Private-Network" header',
     '                     When enabled, sets Access-Control-Allow-Origin to "*"',
     '                     Optional value adds to Access-Control-Allow-Headers',
     '  -H',
@@ -236,6 +239,10 @@ function listen(port) {
     }
   }
 
+  if (argv['private-network-access']) {
+    options.privateNetworkAccess = true;
+  }
+
   if (proxy) {
     try {
       new url.URL(proxy);
@@ -319,6 +326,7 @@ function listen(port) {
       chalk.yellow('\nhttp-server settings: '),
       ([chalk.yellow('COOP: '), argv.coop ? chalk.cyan(argv.coop) : chalk.red('disabled')].join('')),
       ([chalk.yellow('CORS: '), argv.cors ? chalk.cyan(argv.cors) : chalk.red('disabled')].join('')),
+      ([chalk.yellow('Private Network Access: '), argv['private-network-access'] ? chalk.cyan(argv['private-network-access']) : chalk.red('disabled')].join('')),
       ([chalk.yellow('Cache: '), argv.c ? (argv.c === '-1' ? chalk.red('disabled') : chalk.cyan(argv.c + ' seconds')) : chalk.cyan('3600 seconds')].join('')),
       ([chalk.yellow('Connection Timeout: '), Math.max(0, argv.t) === 0 ? chalk.red('disabled') :
         ((!isNaN(argv.t) && !isNaN(parseFloat(argv.t))) ?

doc/http-server.1

@@ -85,6 +85,10 @@ Default Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Ac
 .BI \-H ", " \-\-header " " \fIHEADER\fR
 Add an extra response header (can be used several times)
 
+.TP
+.BI \-\-private-network-access
+Enable Private Network Access via the "Access-Control-Allow-Private-Network" header.
+
 .TP
 .BI \-o " " [\fIPATH\fR]
 Open default browser window after starting the server.

lib/core/aliases.json

@@ -15,6 +15,7 @@
   "handleError": [ "handleError", "handleerror" ],
   "coop": [ "coop", "COOP" ],
   "cors": [ "cors", "CORS" ],
+  "privateNetworkAccess": [ "privateNetworkAccess", "privatenetworkaccess", "private-network-access" ],
   "headers": [ "H", "header", "headers" ],
   "contentType": [ "contentType", "contenttype", "content-type" ],
   "mimeType": [

lib/core/defaults.json

@@ -9,6 +9,7 @@
   "cache": "max-age=3600",
   "coop": false,
   "cors": false,
+  "privateNetworkAccess": false,
   "gzip": true,
   "brotli": false,
   "forceContentEncoding": false,

lib/core/opts.js

@@ -160,6 +160,12 @@ module.exports = (opts) => {
       }
     });
 
+    aliases.privateNetworkAccess.forEach((k) => {
+      if (isDeclared(k) && opts[k]) {
+        headers['Access-Control-Allow-Private-Network'] = 'true';
+      }
+    });
+
     aliases.headers.forEach((k) => {
       if (isDeclared(k)) {
         if (Array.isArray(opts[k])) {

lib/http-server.js

@@ -140,6 +140,10 @@ function HttpServer(options) {
     } : null));
   }
 
+  if (options.privateNetworkAccess) {
+    this.headers['Access-Control-Allow-Private-Network'] = true;
+  }
+
   if (options.robots) {
     before.push(function (req, res) {
       if (req.url === '/robots.txt') {

test/private-network-access.test.js

@@ -0,0 +1,88 @@
+'use strict';
+
+const test = require('tap').test;
+const server = require('../lib/core');
+const http = require('http');
+const path = require('path');
+const request = require('request');
+
+const root = path.join(__dirname, 'public');
+
+test('private-network-access defaults to false', (t) => {
+  t.plan(3);
+
+  const httpServer = http.createServer(
+    server({
+      root,
+      autoIndex: true,
+      defaultExt: 'html',
+    })
+  );
+
+  httpServer.listen(() => {
+    const port = httpServer.address().port;
+    const uri = `http://localhost:${port}/subdir/index.html`;
+
+    request.get({ uri }, (err, res) => {
+      t.ifError(err);
+      t.equal(res.statusCode, 200);
+      t.type(res.headers['access-control-allow-private-network'], 'undefined');
+    });
+  });
+  t.once('end', () => {
+    httpServer.close();
+  });
+});
+
+test('privateNetworkAccess set to false', (t) => {
+  t.plan(3);
+
+  const httpServer = http.createServer(
+    server({
+      root,
+      privateNetworkAccess: false,
+      autoIndex: true,
+      defaultExt: 'html',
+    })
+  );
+
+  httpServer.listen(() => {
+    const port = httpServer.address().port;
+    const uri = `http://localhost:${port}/subdir/index.html`;
+
+    request.get({ uri }, (err, res) => {
+      t.ifError(err);
+      t.equal(res.statusCode, 200);
+      t.type(res.headers['access-control-allow-private-network'], 'undefined');
+    });
+  });
+  t.once('end', () => {
+    httpServer.close();
+  });
+});
+
+test('privateNetworkAccess set to true', (t) => {
+  t.plan(3);
+
+  const httpServer = http.createServer(
+    server({
+      root,
+      privateNetworkAccess: true,
+      autoIndex: true,
+      defaultExt: 'html',
+    })
+  );
+
+  httpServer.listen(() => {
+    const port = httpServer.address().port;
+    const uri = `http://localhost:${port}/subdir/index.html`;
+    request.get({ uri }, (err, res) => {
+      t.ifError(err);
+      t.equal(res.statusCode, 200);
+      t.equal(res.headers['access-control-allow-private-network'], 'true');
+    });
+  });
+  t.once('end', () => {
+    httpServer.close();
+  });
+});