如何在节点js中阻止来自其他域的请求

Question

我是 node js 的新手，有一项任务要做。我有以下代码。我需要阻止来自其他域的请求，除了允许的几个。您能帮我如何执行此任务吗？

import express from 'express';
import bodyParser from 'body-parser';
import cors from 'cors';
import requestIp from 'request-ip';
import os from 'os';
import { AppRoutes, AuthRoutes } from './routes';
import { logger } from './shared-services/logger';
import { MESSAGE } from './constants/index';

const app = express();

app.use(cors());
app.disable('x-powered-by');
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: false }));
app.use((req, res, next)=> {
  const clientIp = requestIp.getClientIp(req);
  logger.debug(JSON.stringify(req.socket.address()));
  logger.debug(`incoming IP ${clientIp}`);
  next();
});

//api Routes.

app.use('/abc', AuthRoutes);

// Check if route exist
app.use((req, res, next) => {
  if (!req.route) {
    logger.error(`${req.originalUrl}, ${MESSAGE.ERROR_NO_ENDPOINT}`);
    res.status(404).send(returnResponseObj(`${req.originalUrl}, ${MESSAGE.ERROR_NO_ENDPOINT}`));
  }
  next();
});

export default app;

提前致谢。

Answer 1

使用 CORS(Cross Orgin Request) 来阻止或添加其他域。

这是 npm 链接

cors npm

var express = require('express')
var cors = require('cors')
var app = express()

var whitelist = ['http://example1.com', 'http://example2.com']
var corsOptions = {
  origin: function (origin, callback) {
    if (whitelist.indexOf(origin) !== -1) {
      callback(null, true)
    } else {
      callback(new Error('Not allowed by CORS'))
    }
 }
}

 app.get('/products/:id', cors(corsOptions), function (req, res, next) {
   res.json({msg: 'This is CORS-enabled for a whitelisted domain.'})
 })