u

src/api/index.js

@@ -46,6 +46,8 @@ let httpsServer;
 let starting;
 let startedAt;
 
+const PRIVATE_HOST_REGEX = /^(127\.0\.0\.1|localhost|192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})$/;
+
 function isAllowedOrigin(origin) {
     if (!origin) return false;
     if (env.corsOrigins.includes(origin)) return true;
@@ -54,6 +56,9 @@ function isAllowedOrigin(origin) {
         if (u.hostname === 'quixpos.com' || u.hostname.endsWith('.quixpos.com')) {
             return true;
         }
+        if (PRIVATE_HOST_REGEX.test(u.hostname)) {
+            return true;
+        }
     } catch {
         // ignore invalid URL
     }
@@ -73,6 +78,26 @@ function corsMiddleware(req, res, next) {
         return next();
     }
 
+    if (req.path.startsWith('/v1')) {
+        if (origin) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            res.setHeader('Vary', 'Origin');
+            res.setHeader('Access-Control-Allow-Credentials', 'true');
+        } else {
+            res.setHeader('Access-Control-Allow-Origin', '*');
+        }
+        const reqHeaders = req.headers['access-control-request-headers'];
+        res.setHeader(
+            'Access-Control-Allow-Headers',
+            reqHeaders || 'Content-Type, Authorization, x-auth-token, authtoken, auth-token, token, x-token'
+        );
+        res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
+        if (req.method === 'OPTIONS') {
+            return res.sendStatus(204);
+        }
+        return next();
+    }
+
     if (origin && isAllowedOrigin(origin)) {
         res.setHeader('Access-Control-Allow-Origin', origin);
         res.setHeader('Vary', 'Origin');