diff --git a/Cargo.lock b/Cargo.lock index 29ced0464..863ae5823 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -789,14 +789,14 @@ dependencies = [ "tower-http 0.2.5", "walkdir", "wasm-bindgen-cli-support", - "zip 0.6.4", + "zip 0.6.5", ] [[package]] name = "dioxus-core" -version = "0.3.2" +version = "0.3.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bc602f0ca7030f80fe4abc47cc43ffa75c6e7f48208c2b3f6ae24ec7bc6f6618" +checksum = "4e4d15b0bb9c58d015b2295f240600dd76e427758377569fa33783afc295706a" dependencies = [ "bumpalo", "bumpslab", @@ -1694,9 +1694,9 @@ checksum = "884e2677b40cc8c339eaefcb701c32ef1fd2493d71118dc0ca4b6a736c93bd67" [[package]] name = "libc" -version = "0.2.142" +version = "0.2.143" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6a987beff54b60ffa6d51982e1aa1146bc42f19bd26be28b0586f252fccf5317" +checksum = "edc207893e85c5d6be840e969b496b53d94cec8be2d501b214f50daa97fa8024" [[package]] name = "libz-sys" @@ -2623,9 +2623,9 @@ dependencies = [ [[package]] name = "serde" -version = "1.0.160" +version = "1.0.162" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bb2f3770c8bce3bcda7e149193a069a0f4365bda1fa5cd88e03bca26afc1216c" +checksum = "71b2f6e1ab5c2b98c05f0f35b236b22e8df7ead6ffbf51d7808da7f8817e7ab6" dependencies = [ "serde_derive", ] @@ -2642,9 +2642,9 @@ dependencies = [ [[package]] name = "serde_derive" -version = "1.0.160" +version = "1.0.162" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "291a097c63d8497e00160b166a967a4a79c64f3facdd01cbd7502231688d77df" +checksum = "a2a0814352fd64b58489904a44ea8d90cb1a91dcb6b4f5ebabc32c8318e93cb6" dependencies = [ "proc-macro2", "quote", @@ -2910,9 +2910,9 @@ dependencies = [ [[package]] name = "time" -version = "0.3.20" +version = "0.3.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cd0cbfecb4d19b5ea75bb31ad904eb5b9fa13f21079c3b92017ebdf4999a5890" +checksum = "8f3403384eaacbca9923fa06940178ac13e4edb725486d70e8e15881d0c836cc" dependencies = [ "serde", "time-core", @@ -2920,9 +2920,9 @@ dependencies = [ [[package]] name = "time-core" -version = "0.1.0" +version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2e153e1f1acaef8acc537e68b44906d2db6436e2b35ac2c6b42640fff91f00fd" +checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb" [[package]] name = "tinyvec" @@ -3861,9 +3861,9 @@ dependencies = [ [[package]] name = "zip" -version = "0.6.4" +version = "0.6.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0445d0fbc924bb93539b4316c11afb121ea39296f99a3c4c9edad09e3658cdef" +checksum = "7e92305c174683d78035cbf1b70e18db6329cc0f1b9cae0a52ca90bf5bfe7125" dependencies = [ "aes", "byteorder", @@ -3875,7 +3875,7 @@ dependencies = [ "hmac", "pbkdf2", "sha1", - "time 0.3.20", + "time 0.3.21", "zstd", ] diff --git a/Cargo.toml b/Cargo.toml index 765aabf30..ff126c419 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -41,7 +41,7 @@ indicatif = "0.17.0-rc.11" subprocess = "0.2.9" axum = { version = "0.5.1", features = ["ws", "headers"] } -tower-http = { version = "0.2.2", features = ["full" ] } +tower-http = { version = "0.2.2", features = ["full"] } headers = "0.3.7" walkdir = "2" diff --git a/docs/src/cmd/serve.md b/docs/src/cmd/serve.md index 2e24cb3f7..dc2d14593 100644 --- a/docs/src/cmd/serve.md +++ b/docs/src/cmd/serve.md @@ -55,3 +55,17 @@ You can add `--open` flag to open system default browser when server startup. ``` dioxus serve --open ``` + + +## Cross Origin Policy + +use `cross-origin-policy` can change corss-origin header in serverside. + +``` + Cross-Origin-Opener-Policy: same-origin + Cross-Origin-Embedder-Policy: require-corp +``` + +``` +dioxus serve --corss-origin-policy +``` \ No newline at end of file diff --git a/src/cli/cfg.rs b/src/cli/cfg.rs index ee6284ac1..cf78e0678 100644 --- a/src/cli/cfg.rs +++ b/src/cli/cfg.rs @@ -77,6 +77,12 @@ pub struct ConfigOptsServe { #[serde(default)] pub hot_reload: bool, + /// Set cross-origin-policy to same-origin [default: false] + #[clap(name="cross-origin-policy")] + #[clap(long)] + #[serde(default)] + pub cross_origin_policy: bool, + /// Space separated list of features to activate #[clap(long)] pub features: Option>, diff --git a/src/cli/serve/mod.rs b/src/cli/serve/mod.rs index e3485c1f1..48113c1c1 100644 --- a/src/cli/serve/mod.rs +++ b/src/cli/serve/mod.rs @@ -20,6 +20,7 @@ impl Serve { // change the relase state. crate_config.with_hot_reload(self.serve.hot_reload); + crate_config.with_cross_origin_policy(self.serve.cross_origin_policy); crate_config.with_release(self.serve.release); crate_config.with_verbose(self.serve.verbose); diff --git a/src/config.rs b/src/config.rs index 171d50a63..9dc95f739 100644 --- a/src/config.rs +++ b/src/config.rs @@ -146,6 +146,7 @@ pub struct CrateConfig { pub dioxus_config: DioxusConfig, pub release: bool, pub hot_reload: bool, + pub cross_origin_policy: bool, pub verbose: bool, pub custom_profile: Option, pub features: Option>, @@ -213,6 +214,7 @@ impl CrateConfig { release, dioxus_config, hot_reload, + cross_origin_policy: false, custom_profile, features, verbose, @@ -234,6 +236,11 @@ impl CrateConfig { self } + pub fn with_cross_origin_policy(&mut self, cross_origin_policy: bool) -> &mut Self { + self.cross_origin_policy = cross_origin_policy; + self + } + pub fn with_verbose(&mut self, verbose: bool) -> &mut Self { self.verbose = verbose; self diff --git a/src/server/mod.rs b/src/server/mod.rs index 912463b43..e422032ab 100644 --- a/src/server/mod.rs +++ b/src/server/mod.rs @@ -176,13 +176,6 @@ pub async fn startup_hot_reload(ip: String, port: u16, config: CrateConfig, star .clone() .unwrap_or_else(|| vec![PathBuf::from("src")]); - let cors = CorsLayer::new() - // allow `GET` and `POST` when accessing the resource - .allow_methods([Method::GET, Method::POST]) - // allow requests from any origin - .allow_origin(Any) - .allow_headers(Any); - let watcher_config = config.clone(); let watcher_ip = ip.clone(); let mut last_update_time = chrono::Local::now().timestamp(); @@ -278,15 +271,34 @@ pub async fn startup_hot_reload(ip: String, port: u16, config: CrateConfig, star }, ); + let cors = CorsLayer::new() + // allow `GET` and `POST` when accessing the resource + .allow_methods([Method::GET, Method::POST]) + // allow requests from any origin + .allow_origin(Any) + .allow_headers(Any); + + let (coep, coop) = if config.cross_origin_policy { + ( + HeaderValue::from_static("require-corp"), + HeaderValue::from_static("same-origin"), + ) + } else { + ( + HeaderValue::from_static("unsafe-none"), + HeaderValue::from_static("unsafe-none"), + ) + }; + let file_service_config = config.clone(); let file_service = ServiceBuilder::new() .override_response_header( HeaderName::from_static("cross-origin-embedder-policy"), - HeaderValue::from_static("require-corp"), + coep, ) .override_response_header( HeaderName::from_static("cross-origin-opener-policy"), - HeaderValue::from_static("same-origin"), + coop, ) .and_then( move |response: Response| async move { @@ -380,13 +392,6 @@ pub async fn startup_default( let mut last_update_time = chrono::Local::now().timestamp(); - let cors = CorsLayer::new() - // allow `GET` and `POST` when accessing the resource - .allow_methods([Method::GET, Method::POST]) - // allow requests from any origin - .allow_origin(Any) - .allow_headers(Any); - // file watcher: check file change let allow_watch_path = config .dioxus_config @@ -450,15 +455,34 @@ pub async fn startup_default( PluginManager::on_serve_start(&config)?; + let cors = CorsLayer::new() + // allow `GET` and `POST` when accessing the resource + .allow_methods([Method::GET, Method::POST]) + // allow requests from any origin + .allow_origin(Any) + .allow_headers(Any); + + let (coep, coop) = if config.cross_origin_policy { + ( + HeaderValue::from_static("require-corp"), + HeaderValue::from_static("same-origin"), + ) + } else { + ( + HeaderValue::from_static("unsafe-none"), + HeaderValue::from_static("unsafe-none"), + ) + }; + let file_service_config = config.clone(); let file_service = ServiceBuilder::new() .override_response_header( HeaderName::from_static("cross-origin-embedder-policy"), - HeaderValue::from_static("require-corp"), + coep, ) .override_response_header( HeaderName::from_static("cross-origin-opener-policy"), - HeaderValue::from_static("same-origin"), + coop, ) .and_then( move |response: Response| async move {