chore: bump to v2.0.0

License: MIT
Signed-off-by: Henrique Dias <hacdias@gmail.com>

README.md

@@ -26,6 +26,20 @@ scope: .
 modify: true
 rules: []
 
+# CORS configuration
+cors:
+  enabled: true
+  credentials: true
+  allowed_headers:
+    - Depth
+  allowed_hosts:
+    - http://localhost:8080
+  allowed_methods:
+    - GET
+  exposed_headers:
+    - Content-Length
+    - Content-Range
+
 users:
   - username: admin
     password: admin
@@ -49,6 +63,13 @@ There are more ways to customize how you run WebDAV through flags and environmen
 
 An example of how to use this with `systemd` is on [webdav.service.example](/webdav.service.example).
 
+### CORS
+
+The `allowed_*` properties are optional, the default value for each of them will be `*`. `exposed_headers` is optional as well, but is not set if not defined. Setting `credentials` to `true` will allow you to:
+
+1. Use `withCredentials = true` in javascript.
+2. Use the `username:password@host` syntax.
+
 ## License
 
 MIT © [Henrique Dias](https://hacdias.com)

cmd/cmd.go

@@ -9,4 +9,4 @@ func Execute() {
 	if err := rootCmd.Execute(); err != nil {
 		log.Fatal(err)
 	}
-}
+}

cmd/config.go

@@ -5,9 +5,10 @@ import (
 	"log"
 	"os"
 	"regexp"
+	"strconv"
 	"strings"
 
-	"github.com/hacdias/webdav/webdav"
+	"github.com/hacdias/webdav/v2/webdav"
 	"github.com/spf13/pflag"
 	v "github.com/spf13/viper"
 	wd "golang.org/x/net/webdav"
@@ -81,6 +82,10 @@ func parseUsers(raw []interface{}, c *webdav.Config) {
 			password, ok := u["password"].(string)
 			if !ok {
 				password = ""
+
+				if numPwd, ok := u["password"].(int); ok {
+					password = strconv.Itoa(numPwd)
+				}
 			}
 
 			if strings.HasPrefix(password, "{env}") {
@@ -118,6 +123,46 @@ func parseUsers(raw []interface{}, c *webdav.Config) {
 	}
 }
 
+func parseCors(cfg map[string]interface{}, c *webdav.Config) {
+	cors := webdav.CorsCfg{
+		Enabled:     cfg["enabled"].(bool),
+		Credentials: cfg["credentials"].(bool),
+	}
+
+	cors.AllowedHeaders = corsProperty("allowed_headers", cfg)
+	cors.AllowedHosts = corsProperty("allowed_hosts", cfg)
+	cors.AllowedMethods = corsProperty("allowed_methods", cfg)
+	cors.ExposedHeaders = corsProperty("exposed_headers", cfg)
+
+	c.Cors = cors
+}
+
+func corsProperty(property string, cfg map[string]interface{}) []string {
+	var def []string
+
+	if property == "exposed_headers" {
+		def = []string{}
+	} else {
+		def = []string{"*"}
+	}
+
+	if allowed, ok := cfg[property].([]interface{}); ok {
+		items := make([]string, len(allowed))
+
+		for idx, a := range allowed {
+			items[idx] = a.(string)
+		}
+
+		if len(items) == 0 {
+			return def
+		} else {
+			return items
+		}
+	}
+
+	return def
+}
+
 func readConfig(flags *pflag.FlagSet) *webdav.Config {
 	cfg := &webdav.Config{
 		User: &webdav.User{
@@ -129,7 +174,11 @@ func readConfig(flags *pflag.FlagSet) *webdav.Config {
 				LockSystem: wd.NewMemLS(),
 			},
 		},
-		Auth:  getOptB(flags, "auth"),
+		Auth: getOptB(flags, "auth"),
+		Cors: webdav.CorsCfg{
+			Enabled:     false,
+			Credentials: false,
+		},
 		Users: map[string]*webdav.User{},
 	}
 
@@ -143,6 +192,11 @@ func readConfig(flags *pflag.FlagSet) *webdav.Config {
 		parseUsers(users, cfg)
 	}
 
+	rawCors := v.Get("cors")
+	if cors, ok := rawCors.(map[string]interface{}); ok {
+		parseCors(cors, cfg)
+	}
+
 	if len(cfg.Users) != 0 && !cfg.Auth {
 		log.Print("Users will be ignored due to auth=false")
 	}

cmd/root.go

@@ -21,6 +21,7 @@ func init() {
 	flags := rootCmd.Flags()
 	flags.StringVarP(&cfgFile, "config", "c", "", "config file path")
 	flags.BoolP("tls", "t", false, "enable tls")
+	flags.Bool("auth", true, "enable auth")
 	flags.String("cert", "cert.pem", "TLS certificate")
 	flags.String("key", "key.pem", "TLS key")
 	flags.StringP("address", "a", "0.0.0.0", "address to listen to")

go.mod

@@ -1,10 +1,9 @@
-module github.com/hacdias/webdav
+module github.com/hacdias/webdav/v2
 
 go 1.12
 
 require (
-	github.com/BurntSushi/toml v0.3.1 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/hacdias/webdav v1.4.1 // indirect
 	github.com/spf13/cobra v0.0.3
 	github.com/spf13/pflag v1.0.3
 	github.com/spf13/viper v1.3.2

go.sum

@@ -8,6 +8,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/hacdias/webdav v1.4.1 h1:yhR4dgKr3JUfgDhFO2nWTq3HiYA37Sk/kaud/bRx1io=
+github.com/hacdias/webdav v1.4.1/go.mod h1:1qXJOCQfiAXgYonkWHIMgWSfbKqUW8F4DlzXxSJCYIg=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=

main.go

@@ -3,7 +3,7 @@ package main
 import (
 	"runtime"
 
-	"github.com/hacdias/webdav/cmd"
+	"github.com/hacdias/webdav/v2/cmd"
 )
 
 func main() {

webdav/utils.go

@@ -14,3 +14,12 @@ func checkPassword(saved, input string) bool {
 
 	return saved == input
 }
+
+func isAllowedHost(allowedHosts []string, origin string) bool {
+	for _, host := range allowedHosts {
+		if host == origin {
+			return true
+		}
+	}
+	return false
+}

webdav/webdav.go

@@ -4,19 +4,68 @@ import (
 	"context"
 	"log"
 	"net/http"
+	"strings"
 )
 
+// CorsCfg is the CORS config.
+type CorsCfg struct {
+	Enabled        bool
+	Credentials    bool
+	AllowedHeaders []string
+	AllowedHosts   []string
+	AllowedMethods []string
+	ExposedHeaders []string
+}
+
 // Config is the configuration of a WebDAV instance.
 type Config struct {
 	*User
 	Auth  bool
+	Cors  CorsCfg
 	Users map[string]*User
 }
 
 // ServeHTTP determines if the request is for this plugin, and if all prerequisites are met.
 func (c *Config) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	u := c.User
+	requestOrigin := r.Header.Get("Origin")
 
+	// Add CORS headers before any operation so even on a 401 unauthorized status, CORS will work.
+	if c.Cors.Enabled && requestOrigin != "" {
+		headers := w.Header()
+
+		allowedHeaders := strings.Join(c.Cors.AllowedHeaders, ", ")
+		allowedMethods := strings.Join(c.Cors.AllowedMethods, ", ")
+		exposedHeaders := strings.Join(c.Cors.ExposedHeaders, ", ")
+
+		allowAllHosts := len(c.Cors.AllowedHosts) == 1 && c.Cors.AllowedHosts[0] == "*"
+		allowedHost := isAllowedHost(c.Cors.AllowedHosts, requestOrigin)
+
+		if allowAllHosts {
+			headers.Set("Access-Control-Allow-Origin", "*")
+		} else if allowedHost {
+			headers.Set("Access-Control-Allow-Origin", requestOrigin)
+		}
+
+		if allowAllHosts || allowedHost {
+			headers.Set("Access-Control-Allow-Headers", allowedHeaders)
+			headers.Set("Access-Control-Allow-Methods", allowedMethods)
+
+			if c.Cors.Credentials {
+				headers.Set("Access-Control-Allow-Credentials", "true")
+			}
+
+			if len(c.Cors.ExposedHeaders) > 0 {
+				headers.Set("Access-Control-Expose-Headers", exposedHeaders)
+			}
+		}
+	}
+
+	if r.Method == "OPTIONS" && c.Cors.Enabled && requestOrigin != "" {
+		return
+	}
+
+	// Authentication
 	if c.Auth {
 		w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)