mirror of
https://github.com/openmhz/trunk-server.git
synced 2026-11-09 23:37:31 -05:00
62 lines
2.7 KiB
JavaScript
62 lines
2.7 KiB
JavaScript
var path = require("path");
|
|
var express = require("express");
|
|
var bodyParser = require("body-parser");
|
|
|
|
var backend_server = process.env['REACT_APP_BACKEND_SERVER'] != null ? process.env['REACT_APP_BACKEND_SERVER'] : 'https://api.openmhz.com';
|
|
var frontend_server = process.env['REACT_APP_FRONTEND_SERVER'] != null ? process.env['REACT_APP_FRONTEND_SERVER'] : 'https://openmhz.com';
|
|
var admin_server = process.env['REACT_APP_ADMIN_SERVER'] != null ? process.env['REACT_APP_ADMIN_SERVER'] : 'https://admin.openmhz.com';
|
|
var dev_server = frontend_server + ":3000"
|
|
|
|
|
|
module.exports = function(app) {
|
|
app.set("port", 3005)
|
|
|
|
// X-Powered-By header has no functional value.
|
|
// Keeping it makes it easier for an attacker to build the site's profile
|
|
// It can be removed safely
|
|
app.disable("x-powered-by")
|
|
app.enable('trust proxy')
|
|
app.use(bodyParser.json())
|
|
app.use(bodyParser.urlencoded({ extended: true }))
|
|
app.use(express.static(path.join(process.cwd(), 'public')));
|
|
|
|
var node_env = process.env.NODE_ENV;
|
|
console.log('--------------------------');
|
|
console.log('===> 😊 Starting Server . . .');
|
|
console.log('===> Environment: ' + node_env);
|
|
if(node_env === 'production') {
|
|
console.log('===> 🚦 Note: In order for authentication to work in production');
|
|
console.log('===> you will need a secure HTTPS connection');
|
|
}
|
|
|
|
app.use('/*', function(req, res, next) {
|
|
var allowedOrigins = [ admin_server];
|
|
allowedOrigins.push(frontend_server);
|
|
allowedOrigins.push(backend_server);
|
|
allowedOrigins.push(dev_server);
|
|
allowedOrigins.push("https://www.openmhz.com");
|
|
|
|
var origin = req.headers.origin;
|
|
|
|
if (allowedOrigins.indexOf(origin) > -1) {
|
|
res.setHeader('Access-Control-Allow-Origin', origin);
|
|
} else if (req.headers["user-agent"] == 'TrunkRecorder1.0') {
|
|
res.setHeader('Access-Control-Allow-Origin', "*");
|
|
} else if (origin &&origin.indexOf(".vercel.app") > -1) {
|
|
next("Scraper!! ☠️ " + origin);
|
|
} else {
|
|
res.setHeader('Access-Control-Allow-Origin', "*");
|
|
if (origin) {
|
|
console.warn("forcing CORS for: " + origin + " referer: " + req.headers.referer + " url: " + req.originalUrl);
|
|
}
|
|
}
|
|
res.header("Access-Control-Allow-Headers", "X-Requested-With");
|
|
res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS,WEBSOCKET');
|
|
res.header('Access-Control-Allow-Credentials', 'true');
|
|
res.header("Access-Control-Allow-Headers", "Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Access-Control-Max-Age");
|
|
res.header('Access-Control-Max-Age', '600');
|
|
next();
|
|
});
|
|
|
|
}
|