Add support for overriding cors response header values

README.md

@@ -288,6 +288,14 @@ If for whatever reason you want to turn of CORS support do so via
 
     $ canned --cors=false ./my/responses/
 
+If you need to override the values of the cors response headers
+
+    $ canned \
+    --access_control_allow_credentials "true" \
+    --access_control_allow_headers "authorization" \
+    --access_control_allow_origin "http://0.0.0.0:3000" \
+    ./my/responses/
+
 Also if you need additional headers to be served alongside the CORS headers
 these can be added like this (thanks to runemadsen)
 
@@ -355,6 +363,7 @@ feel free to [bug me on twitter](https://twitter.com/ischi)
 Release History
 ---------------
 ### next
+* adding support for overridding cors response header values
 * adding PATCH to default Access-Control-Allow-Method Cors header #113 (@william-mcmillian)
 * adding support for delayed responses #114 (@Onatolich)
 * adding support to make sanatize optional #115 (@YuliyaMarholina)
@@ -453,6 +462,7 @@ Contributors
 * [mazoni](https://github.com/mazoni)
 * [william-mcmillian](https://github.com/william-mcmillian)
 * [Onatolich](https://github.com/Onatolich)
+* [stollcri](https://github.com/stollcri)
 
 License
 -------

bin/canned

@@ -18,6 +18,12 @@ var canned = require('../index')
           .describe('cors', 'disable cors support')
           .default('headers', false)
           .describe('headers', 'add custom headers allowed in cors requests')
+          .default('access_control_allow_credentials', 'false')
+          .describe('access_control_allow_credentials', 'overide cors credentials')
+          .default('access_control_allow_headers', 'X-Requested-With')
+          .describe('access_control_allow_headers', 'overide cors headers')
+          .default('access_control_allow_origin', '*')
+          .describe('access_control_allow_origin', 'overide cors origin')
           .default('h', false)
           .alias('h', 'help')
           .describe('h', 'show the help')
@@ -34,6 +40,9 @@ var dir = ''
 ,   relaxed_accept = argv.relaxed_accept
 ,   cors = argv.cors
 ,   cors_headers = argv.headers
+,   access_control_allow_credentials = argv.access_control_allow_credentials
+,   access_control_allow_headers = argv.access_control_allow_headers
+,   access_control_allow_origin = argv.access_control_allow_origin
 ,   logger
 ,   cannedDir
 ,   wildcard = argv.wildcard
@@ -53,6 +62,9 @@ var can = canned(dir, {
   relaxed_accept: relaxed_accept,
   cors: cors,
   cors_headers: cors_headers,
+  access_control_allow_credentials: access_control_allow_credentials,
+  access_control_allow_headers: access_control_allow_headers,
+  access_control_allow_origin: access_control_allow_origin,
   wildcard: wildcard,
   response_delay: response_delay
 })

lib/canned.js

@@ -21,7 +21,10 @@ function Canned(dir, options) {
   this.response_opts = {
     response_delay: options.response_delay,
     cors_enabled: options.cors,
-    cors_headers: cors_headers
+    cors_headers: cors_headers,
+    access_control_allow_credentials: options.access_control_allow_credentials,
+    access_control_allow_headers: options.access_control_allow_headers,
+    access_control_allow_origin: options.access_control_allow_origin
   }
   this.dir = process.cwd() + '/' + dir
 }

lib/response.js

@@ -4,6 +4,9 @@ var fs = require('fs')
 function Response(content_type, content, statusCode, res, options, custom_headers) {
   this.cors_enabled = !!options.cors_enabled
   this.cors_headers = options.cors_headers
+  this.access_control_allow_credentials = options.access_control_allow_credentials || 'false'
+  this.access_control_allow_headers = options.access_control_allow_headers || 'X-Requested-With'
+  this.access_control_allow_origin = options.access_control_allow_origin || '*'
   this.response_delay = options.response_delay
   this.content_type = content_type
   this.content = content
@@ -19,12 +22,6 @@ Response.content_types = {
   'js': 'application/javascript'
 }
 
-Response.cors_headers = [
-  ['Access-Control-Allow-Origin', '*'],
-  ['Access-Control-Allow-Headers', 'X-Requested-With'],
-  ['Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS']
-]
-
 Response.prototype.send = function () {
   this.headers().forEach(function (header) {
     this.res.setHeader(header[0], header[1])
@@ -52,12 +49,14 @@ Response.prototype._addContentTypeHeaders = function (headers) {
 Response.prototype._addCORSHeaders = function (headers) {
   var that = this;
   if (this.cors_enabled) {
-    Response.cors_headers.forEach(function (h) {
-      if (!!that.cors_headers && h[0] === 'Access-Control-Allow-Headers')
-        headers.push([h[0], h[1] + ", " + that.cors_headers])
-      else
-        headers.push(h)
-    })
+    headers.push(['Access-Control-Allow-Credentials', that.access_control_allow_credentials])
+    if (!!that.cors_headers) {
+      headers.push(['Access-Control-Allow-Headers', that.access_control_allow_headers + ", " + that.cors_headers])
+    } else {
+      headers.push(['Access-Control-Allow-Headers', that.access_control_allow_headers])
+    }
+    headers.push(['Access-Control-Allow-Origin', that.access_control_allow_origin])
+    headers.push(['Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS'])
   }
   return headers
 }

spec/canned.spec.js

@@ -461,6 +461,30 @@ describe('canned', function () {
       }
       can2(req, res)
     })
+
+    it('overrides Access-Control-Allow-* response headers', function (done) {
+      var can2 = canned('./spec/test_responses', {
+        cors: true,
+        access_control_allow_credentials: "true",
+        access_control_allow_headers: "authorization",
+        access_control_allow_origin: "http://0.0.0.0:3000"
+      })
+      req.url = '/'
+      var expectedHeaders = {
+        'Access-Control-Allow-Credentials': "true",
+        'Access-Control-Allow-Headers': "authorization",
+        'Access-Control-Allow-Origin': "http://0.0.0.0:3000"
+      }
+      res.setHeader = function (name, value) {
+        if (expectedHeaders[name]) {
+          expect(expectedHeaders[name]).toBe(value)
+          delete expectedHeaders[name]
+        }
+        // all expected headers have been set!
+        if (Object.keys(expectedHeaders).length === 0) done()
+      }
+      can2(req, res)
+    })
   })
 
   describe('variable GET responses', function () {