feat(middleware/cors): Add support for Access-Control-Allow-Private-Network

docs/api/middleware/cors.md

@@ -80,6 +80,9 @@ app.Use(cors.New(cors.Config{
 | ExposeHeaders    | `string`                   | ExposeHeaders defines a whitelist headers that clients are allowed to access.                                                                                                                                                                                                                                                                                      | `""`                               |
 | MaxAge           | `int`                      | MaxAge indicates how long (in seconds) the results of a preflight request can be cached. If you pass MaxAge 0, Access-Control-Max-Age header will not be added and browser will use 5 seconds by default. To disable caching completely, pass MaxAge value negative. It will set the Access-Control-Max-Age header 0.                                              | `0`                                |
 
+| `AllowPrivateNetwork`  | `bool`  | Indicates whether the `Access-Control-Allow-Private-Network` response header should be set to `true`, allowing requests from private networks. This aligns with modern security practices for web applications interacting with private networks. |
+
+
 ## Default Config
 
 ```go
@@ -99,5 +102,6 @@ var ConfigDefault = Config{
 	AllowCredentials: false,
 	ExposeHeaders:    "",
 	MaxAge:           0,
+	AllowPrivateNetwork: false,
 }
 ```

helpers.go

@@ -856,128 +856,129 @@ var (
 
 // HTTP Headers were copied from net/http.
 const (
-	HeaderAuthorization                   = "Authorization"
-	HeaderProxyAuthenticate               = "Proxy-Authenticate"
-	HeaderProxyAuthorization              = "Proxy-Authorization"
-	HeaderWWWAuthenticate                 = "WWW-Authenticate"
-	HeaderAge                             = "Age"
-	HeaderCacheControl                    = "Cache-Control"
-	HeaderClearSiteData                   = "Clear-Site-Data"
-	HeaderExpires                         = "Expires"
-	HeaderPragma                          = "Pragma"
-	HeaderWarning                         = "Warning"
-	HeaderAcceptCH                        = "Accept-CH"
-	HeaderAcceptCHLifetime                = "Accept-CH-Lifetime"
-	HeaderContentDPR                      = "Content-DPR"
-	HeaderDPR                             = "DPR"
-	HeaderEarlyData                       = "Early-Data"
-	HeaderSaveData                        = "Save-Data"
-	HeaderViewportWidth                   = "Viewport-Width"
-	HeaderWidth                           = "Width"
-	HeaderETag                            = "ETag"
-	HeaderIfMatch                         = "If-Match"
-	HeaderIfModifiedSince                 = "If-Modified-Since"
-	HeaderIfNoneMatch                     = "If-None-Match"
-	HeaderIfUnmodifiedSince               = "If-Unmodified-Since"
-	HeaderLastModified                    = "Last-Modified"
-	HeaderVary                            = "Vary"
-	HeaderConnection                      = "Connection"
-	HeaderKeepAlive                       = "Keep-Alive"
-	HeaderAccept                          = "Accept"
-	HeaderAcceptCharset                   = "Accept-Charset"
-	HeaderAcceptEncoding                  = "Accept-Encoding"
-	HeaderAcceptLanguage                  = "Accept-Language"
-	HeaderCookie                          = "Cookie"
-	HeaderExpect                          = "Expect"
-	HeaderMaxForwards                     = "Max-Forwards"
-	HeaderSetCookie                       = "Set-Cookie"
-	HeaderAccessControlAllowCredentials   = "Access-Control-Allow-Credentials"
-	HeaderAccessControlAllowHeaders       = "Access-Control-Allow-Headers"
-	HeaderAccessControlAllowMethods       = "Access-Control-Allow-Methods"
-	HeaderAccessControlAllowOrigin        = "Access-Control-Allow-Origin"
-	HeaderAccessControlExposeHeaders      = "Access-Control-Expose-Headers"
-	HeaderAccessControlMaxAge             = "Access-Control-Max-Age"
-	HeaderAccessControlRequestHeaders     = "Access-Control-Request-Headers"
-	HeaderAccessControlRequestMethod      = "Access-Control-Request-Method"
-	HeaderOrigin                          = "Origin"
-	HeaderTimingAllowOrigin               = "Timing-Allow-Origin"
-	HeaderXPermittedCrossDomainPolicies   = "X-Permitted-Cross-Domain-Policies"
-	HeaderDNT                             = "DNT"
-	HeaderTk                              = "Tk"
-	HeaderContentDisposition              = "Content-Disposition"
-	HeaderContentEncoding                 = "Content-Encoding"
-	HeaderContentLanguage                 = "Content-Language"
-	HeaderContentLength                   = "Content-Length"
-	HeaderContentLocation                 = "Content-Location"
-	HeaderContentType                     = "Content-Type"
-	HeaderForwarded                       = "Forwarded"
-	HeaderVia                             = "Via"
-	HeaderXForwardedFor                   = "X-Forwarded-For"
-	HeaderXForwardedHost                  = "X-Forwarded-Host"
-	HeaderXForwardedProto                 = "X-Forwarded-Proto"
-	HeaderXForwardedProtocol              = "X-Forwarded-Protocol"
-	HeaderXForwardedSsl                   = "X-Forwarded-Ssl"
-	HeaderXUrlScheme                      = "X-Url-Scheme"
-	HeaderLocation                        = "Location"
-	HeaderFrom                            = "From"
-	HeaderHost                            = "Host"
-	HeaderReferer                         = "Referer"
-	HeaderReferrerPolicy                  = "Referrer-Policy"
-	HeaderUserAgent                       = "User-Agent"
-	HeaderAllow                           = "Allow"
-	HeaderServer                          = "Server"
-	HeaderAcceptRanges                    = "Accept-Ranges"
-	HeaderContentRange                    = "Content-Range"
-	HeaderIfRange                         = "If-Range"
-	HeaderRange                           = "Range"
-	HeaderContentSecurityPolicy           = "Content-Security-Policy"
-	HeaderContentSecurityPolicyReportOnly = "Content-Security-Policy-Report-Only"
-	HeaderCrossOriginResourcePolicy       = "Cross-Origin-Resource-Policy"
-	HeaderExpectCT                        = "Expect-CT"
-	HeaderPermissionsPolicy               = "Permissions-Policy"
-	HeaderPublicKeyPins                   = "Public-Key-Pins"
-	HeaderPublicKeyPinsReportOnly         = "Public-Key-Pins-Report-Only"
-	HeaderStrictTransportSecurity         = "Strict-Transport-Security"
-	HeaderUpgradeInsecureRequests         = "Upgrade-Insecure-Requests"
-	HeaderXContentTypeOptions             = "X-Content-Type-Options"
-	HeaderXDownloadOptions                = "X-Download-Options"
-	HeaderXFrameOptions                   = "X-Frame-Options"
-	HeaderXPoweredBy                      = "X-Powered-By"
-	HeaderXXSSProtection                  = "X-XSS-Protection"
-	HeaderLastEventID                     = "Last-Event-ID"
-	HeaderNEL                             = "NEL"
-	HeaderPingFrom                        = "Ping-From"
-	HeaderPingTo                          = "Ping-To"
-	HeaderReportTo                        = "Report-To"
-	HeaderTE                              = "TE"
-	HeaderTrailer                         = "Trailer"
-	HeaderTransferEncoding                = "Transfer-Encoding"
-	HeaderSecWebSocketAccept              = "Sec-WebSocket-Accept"
-	HeaderSecWebSocketExtensions          = "Sec-WebSocket-Extensions"
-	HeaderSecWebSocketKey                 = "Sec-WebSocket-Key"
-	HeaderSecWebSocketProtocol            = "Sec-WebSocket-Protocol"
-	HeaderSecWebSocketVersion             = "Sec-WebSocket-Version"
-	HeaderAcceptPatch                     = "Accept-Patch"
-	HeaderAcceptPushPolicy                = "Accept-Push-Policy"
-	HeaderAcceptSignature                 = "Accept-Signature"
-	HeaderAltSvc                          = "Alt-Svc"
-	HeaderDate                            = "Date"
-	HeaderIndex                           = "Index"
-	HeaderLargeAllocation                 = "Large-Allocation"
-	HeaderLink                            = "Link"
-	HeaderPushPolicy                      = "Push-Policy"
-	HeaderRetryAfter                      = "Retry-After"
-	HeaderServerTiming                    = "Server-Timing"
-	HeaderSignature                       = "Signature"
-	HeaderSignedHeaders                   = "Signed-Headers"
-	HeaderSourceMap                       = "SourceMap"
-	HeaderUpgrade                         = "Upgrade"
-	HeaderXDNSPrefetchControl             = "X-DNS-Prefetch-Control"
-	HeaderXPingback                       = "X-Pingback"
-	HeaderXRequestID                      = "X-Request-ID"
-	HeaderXRequestedWith                  = "X-Requested-With"
-	HeaderXRobotsTag                      = "X-Robots-Tag"
-	HeaderXUACompatible                   = "X-UA-Compatible"
+	HeaderAuthorization                    = "Authorization"
+	HeaderProxyAuthenticate                = "Proxy-Authenticate"
+	HeaderProxyAuthorization               = "Proxy-Authorization"
+	HeaderWWWAuthenticate                  = "WWW-Authenticate"
+	HeaderAge                              = "Age"
+	HeaderCacheControl                     = "Cache-Control"
+	HeaderClearSiteData                    = "Clear-Site-Data"
+	HeaderExpires                          = "Expires"
+	HeaderPragma                           = "Pragma"
+	HeaderWarning                          = "Warning"
+	HeaderAcceptCH                         = "Accept-CH"
+	HeaderAcceptCHLifetime                 = "Accept-CH-Lifetime"
+	HeaderContentDPR                       = "Content-DPR"
+	HeaderDPR                              = "DPR"
+	HeaderEarlyData                        = "Early-Data"
+	HeaderSaveData                         = "Save-Data"
+	HeaderViewportWidth                    = "Viewport-Width"
+	HeaderWidth                            = "Width"
+	HeaderETag                             = "ETag"
+	HeaderIfMatch                          = "If-Match"
+	HeaderIfModifiedSince                  = "If-Modified-Since"
+	HeaderIfNoneMatch                      = "If-None-Match"
+	HeaderIfUnmodifiedSince                = "If-Unmodified-Since"
+	HeaderLastModified                     = "Last-Modified"
+	HeaderVary                             = "Vary"
+	HeaderConnection                       = "Connection"
+	HeaderKeepAlive                        = "Keep-Alive"
+	HeaderAccept                           = "Accept"
+	HeaderAcceptCharset                    = "Accept-Charset"
+	HeaderAcceptEncoding                   = "Accept-Encoding"
+	HeaderAcceptLanguage                   = "Accept-Language"
+	HeaderCookie                           = "Cookie"
+	HeaderExpect                           = "Expect"
+	HeaderMaxForwards                      = "Max-Forwards"
+	HeaderSetCookie                        = "Set-Cookie"
+	HeaderAccessControlAllowCredentials    = "Access-Control-Allow-Credentials"
+	HeaderAccessControlAllowHeaders        = "Access-Control-Allow-Headers"
+	HeaderAccessControlAllowMethods        = "Access-Control-Allow-Methods"
+	HeaderAccessControlAllowOrigin         = "Access-Control-Allow-Origin"
+	HeaderAccessControlExposeHeaders       = "Access-Control-Expose-Headers"
+	HeaderAccessControlMaxAge              = "Access-Control-Max-Age"
+	HeaderAccessControlRequestHeaders      = "Access-Control-Request-Headers"
+	HeaderAccessControlRequestMethod       = "Access-Control-Request-Method"
+	HeaderOrigin                           = "Origin"
+	HeaderTimingAllowOrigin                = "Timing-Allow-Origin"
+	HeaderXPermittedCrossDomainPolicies    = "X-Permitted-Cross-Domain-Policies"
+	HeaderDNT                              = "DNT"
+	HeaderTk                               = "Tk"
+	HeaderContentDisposition               = "Content-Disposition"
+	HeaderContentEncoding                  = "Content-Encoding"
+	HeaderContentLanguage                  = "Content-Language"
+	HeaderContentLength                    = "Content-Length"
+	HeaderContentLocation                  = "Content-Location"
+	HeaderContentType                      = "Content-Type"
+	HeaderForwarded                        = "Forwarded"
+	HeaderVia                              = "Via"
+	HeaderXForwardedFor                    = "X-Forwarded-For"
+	HeaderXForwardedHost                   = "X-Forwarded-Host"
+	HeaderXForwardedProto                  = "X-Forwarded-Proto"
+	HeaderXForwardedProtocol               = "X-Forwarded-Protocol"
+	HeaderXForwardedSsl                    = "X-Forwarded-Ssl"
+	HeaderXUrlScheme                       = "X-Url-Scheme"
+	HeaderLocation                         = "Location"
+	HeaderFrom                             = "From"
+	HeaderHost                             = "Host"
+	HeaderReferer                          = "Referer"
+	HeaderReferrerPolicy                   = "Referrer-Policy"
+	HeaderUserAgent                        = "User-Agent"
+	HeaderAllow                            = "Allow"
+	HeaderServer                           = "Server"
+	HeaderAcceptRanges                     = "Accept-Ranges"
+	HeaderContentRange                     = "Content-Range"
+	HeaderIfRange                          = "If-Range"
+	HeaderRange                            = "Range"
+	HeaderContentSecurityPolicy            = "Content-Security-Policy"
+	HeaderContentSecurityPolicyReportOnly  = "Content-Security-Policy-Report-Only"
+	HeaderCrossOriginResourcePolicy        = "Cross-Origin-Resource-Policy"
+	HeaderExpectCT                         = "Expect-CT"
+	HeaderPermissionsPolicy                = "Permissions-Policy"
+	HeaderPublicKeyPins                    = "Public-Key-Pins"
+	HeaderPublicKeyPinsReportOnly          = "Public-Key-Pins-Report-Only"
+	HeaderStrictTransportSecurity          = "Strict-Transport-Security"
+	HeaderUpgradeInsecureRequests          = "Upgrade-Insecure-Requests"
+	HeaderXContentTypeOptions              = "X-Content-Type-Options"
+	HeaderXDownloadOptions                 = "X-Download-Options"
+	HeaderXFrameOptions                    = "X-Frame-Options"
+	HeaderXPoweredBy                       = "X-Powered-By"
+	HeaderXXSSProtection                   = "X-XSS-Protection"
+	HeaderLastEventID                      = "Last-Event-ID"
+	HeaderNEL                              = "NEL"
+	HeaderPingFrom                         = "Ping-From"
+	HeaderPingTo                           = "Ping-To"
+	HeaderReportTo                         = "Report-To"
+	HeaderTE                               = "TE"
+	HeaderTrailer                          = "Trailer"
+	HeaderTransferEncoding                 = "Transfer-Encoding"
+	HeaderSecWebSocketAccept               = "Sec-WebSocket-Accept"
+	HeaderSecWebSocketExtensions           = "Sec-WebSocket-Extensions"
+	HeaderSecWebSocketKey                  = "Sec-WebSocket-Key"
+	HeaderSecWebSocketProtocol             = "Sec-WebSocket-Protocol"
+	HeaderSecWebSocketVersion              = "Sec-WebSocket-Version"
+	HeaderAcceptPatch                      = "Accept-Patch"
+	HeaderAcceptPushPolicy                 = "Accept-Push-Policy"
+	HeaderAcceptSignature                  = "Accept-Signature"
+	HeaderAltSvc                           = "Alt-Svc"
+	HeaderDate                             = "Date"
+	HeaderIndex                            = "Index"
+	HeaderLargeAllocation                  = "Large-Allocation"
+	HeaderLink                             = "Link"
+	HeaderPushPolicy                       = "Push-Policy"
+	HeaderRetryAfter                       = "Retry-After"
+	HeaderServerTiming                     = "Server-Timing"
+	HeaderSignature                        = "Signature"
+	HeaderSignedHeaders                    = "Signed-Headers"
+	HeaderSourceMap                        = "SourceMap"
+	HeaderUpgrade                          = "Upgrade"
+	HeaderXDNSPrefetchControl              = "X-DNS-Prefetch-Control"
+	HeaderXPingback                        = "X-Pingback"
+	HeaderXRequestID                       = "X-Request-ID"
+	HeaderXRequestedWith                   = "X-Requested-With"
+	HeaderXRobotsTag                       = "X-Robots-Tag"
+	HeaderXUACompatible                    = "X-UA-Compatible"
+	HeaderAccessControlAllowPrivateNetwork = "Access-Control-Allow-Private-Network"
 )
 
 // Network types that are commonly used

middleware/cors/cors.go

@@ -63,6 +63,12 @@ type Config struct {
 	//
 	// Optional. Default value 0.
 	MaxAge int
+
+	// AllowPrivateNetwork indicates whether the Access-Control-Allow-Private-Network
+	// response header should be set to true, allowing requests from private networks.
+	//
+	// Optional. Default value false.
+	AllowPrivateNetwork bool
 }
 
 // ConfigDefault is the default config
@@ -78,10 +84,11 @@ var ConfigDefault = Config{
 		fiber.MethodDelete,
 		fiber.MethodPatch,
 	}, ","),
-	AllowHeaders:     "",
-	AllowCredentials: false,
-	ExposeHeaders:    "",
-	MaxAge:           0,
+	AllowHeaders:        "",
+	AllowCredentials:    false,
+	ExposeHeaders:       "",
+	MaxAge:              0,
+	AllowPrivateNetwork: false,
 }
 
 // New creates a new middleware handler
@@ -227,6 +234,12 @@ func New(config ...Config) fiber.Handler {
 			c.Set(fiber.HeaderAccessControlMaxAge, "0")
 		}
 
+		// Set Preflight request handling
+		if cfg.AllowPrivateNetwork && c.Get("Access-Control-Request-Private-Network") == "true" {
+			// Set the Access-Control-Allow-Private-Network header to "true"
+			c.Set(fiber.HeaderAccessControlAllowPrivateNetwork, "true")
+		}
+
 		// Send 204 No Content
 		return c.SendStatus(fiber.StatusNoContent)
 	}