rejectNoCorsRequestMiddleware() — vite Function Reference

Architecture documentation for the rejectNoCorsRequestMiddleware() function in rejectNoCorsRequest.ts from the vite codebase.

Function typescript ViteCore ConfigEngine called by 1

Entity Profile

ViteCore→ ConfigEngine→ rejectNoCorsRequestMiddleware() — vite Function Reference

Dependency Diagram

graph TD
  18e7c965_854a_9229_ae34_35029084d183["rejectNoCorsRequestMiddleware()"]
  9f34ee4d_41ed_f961_b44b_324bb9f1ea7a["rejectNoCorsRequest.ts"]
  18e7c965_854a_9229_ae34_35029084d183 -->|defined in| 9f34ee4d_41ed_f961_b44b_324bb9f1ea7a
  24ecf2a1_3c09_d451_76f3_9485b4e993f8["_createServer()"]
  24ecf2a1_3c09_d451_76f3_9485b4e993f8 -->|calls| 18e7c965_854a_9229_ae34_35029084d183
  style 18e7c965_854a_9229_ae34_35029084d183 fill:#6366f1,stroke:#818cf8,color:#fff

Relationship Graph

Source Code

packages/vite/src/node/server/middlewares/rejectNoCorsRequest.ts lines 17–36

export function rejectNoCorsRequestMiddleware(): Connect.NextHandleFunction {
  // Keep the named function. The name is visible in debug logs via `DEBUG=connect:dispatcher ...`
  return function viteRejectNoCorsRequestMiddleware(req, res, next) {
    // While we can set Cross-Origin-Resource-Policy header instead of rejecting requests,
    // we choose to reject the request to be safer in case the request handler has any side-effects.
    if (
      req.headers['sec-fetch-mode'] === 'no-cors' &&
      req.headers['sec-fetch-site'] !== 'same-origin' &&
      // we only need to block classic script requests
      req.headers['sec-fetch-dest'] === 'script'
    ) {
      res.statusCode = 403
      res.end(
        'Cross-origin requests for classic scripts must be made with CORS mode enabled. Make sure to set the "crossorigin" attribute on your <script> tag.',
      )
      return
    }
    return next()
  }
}