feat(middleware/cors): Add support for Access-Control-Allow-Private-Network

docs/api/middleware/cors.md

@@ -80,6 +80,9 @@ app.Use(cors.New(cors.Config{
 | ExposeHeaders    | `string`                   | ExposeHeaders defines a whitelist headers that clients are allowed to access.                                                                                                                                                                                                                                                                                      | `""`                               |
 | MaxAge           | `int`                      | MaxAge indicates how long (in seconds) the results of a preflight request can be cached. If you pass MaxAge 0, Access-Control-Max-Age header will not be added and browser will use 5 seconds by default. To disable caching completely, pass MaxAge value negative. It will set the Access-Control-Max-Age header 0.                                              | `0`                                |
 
+| `AllowPrivateNetworkAccess`  | `bool`  | Indicates whether the `Access-Control-Allow-Private-Network` response header should be set to `true`, allowing requests from private networks. This aligns with modern security practices for web applications interacting with private networks. |
+
+
 ## Default Config
 
 ```go
@@ -99,5 +102,6 @@ var ConfigDefault = Config{
 	AllowCredentials: false,
 	ExposeHeaders:    "",
 	MaxAge:           0,
+	AllowPrivateNetworkAccess: false,
 }
 ```

helpers.go

@@ -856,7 +856,7 @@
 
 // HTTP Headers were copied from net/http.
 const (
 	HeaderAuthorization                   = "Authorization"
 	HeaderProxyAuthenticate               = "Proxy-Authenticate"
 	HeaderProxyAuthorization              = "Proxy-Authorization"
 	HeaderWWWAuthenticate                 = "WWW-Authenticate"
@@ -978,6 +978,7 @@
 	HeaderXRequestedWith                  = "X-Requested-With"
 	HeaderXRobotsTag                      = "X-Robots-Tag"
 	HeaderXUACompatible                   = "X-UA-Compatible"
+	HeaderAccessControlAllowPrivateNetwork = "Access-Control-Allow-Private-Network"
 )
 
 // Network types that are commonly used

middleware/cors/cors.go

@@ -63,6 +63,12 @@ type Config struct {
 	//
 	// Optional. Default value 0.
 	MaxAge int
+
+	// AllowPrivateNetworkAccess indicates whether the Access-Control-Allow-Private-Network
+	// response header should be set to true, allowing requests from private networks.
+	//
+	// Optional. Default value false.
+	AllowPrivateNetworkAccess bool
 }
 
 // ConfigDefault is the default config
@@ -227,6 +233,12 @@ func New(config ...Config) fiber.Handler {
 			c.Set(fiber.HeaderAccessControlMaxAge, "0")
 		}
 
+		// Set Preflight request handling
+		if cfg.AllowPrivateNetworkAccess {
+			// Set the Access-Control-Allow-Private-Network header to "true"
+			c.Set(fiber.HeaderAccessControlAllowPrivateNetwork, "true")
+		}
+
 		// Send 204 No Content
 		return c.SendStatus(fiber.StatusNoContent)
 	}

middleware/cors/cors_test.go

@@ -689,6 +689,43 @@
 	}
 }
 
+// The Enhancement for issue #2804
+func Test_CORS_AllowPrivateNetworkAccess(t *testing.T) {
+	t.Parallel()
+
+	// Test scenario where AllowPrivateNetworkAccess is enabled
+	app := fiber.New()
+	app.Use(New(Config{
+		AllowPrivateNetworkAccess: true,
+	}))
+
+	handler := app.Handler()
+
+	ctx := &fasthttp.RequestCtx{}
+	ctx.Request.Header.SetMethod(fiber.MethodOptions)
+	ctx.Request.Header.Set(fiber.HeaderOrigin, "https://example.com")
+	ctx.Request.Header.Set("Access-Control-Request-Private-Network", "true")
+	handler(ctx)
+
+	// Verify the Access-Control-Allow-Private-Network header is set to "true"
+	require.Equal(t, "true", string(ctx.Response.Header.Peek("Access-Control-Allow-Private-Network")), "The Access-Control-Allow-Private-Network header should be set to 'true' when AllowPrivateNetworkAccess is enabled")
+
+	// Reset ctx for next test
+	ctx = &fasthttp.RequestCtx{}
+	ctx.Request.Header.SetMethod(fiber.MethodOptions)
+	ctx.Request.Header.Set(fiber.HeaderOrigin, "https://example.com")
+
+	// Test scenario where AllowPrivateNetworkAccess is disabled (default)
+	app = fiber.New()
+	app.Use(New())
+
+	handler = app.Handler()
+	handler(ctx)
+
+	// Verify the Access-Control-Allow-Private-Network header is not present
+	require.Equal(t, "", string(ctx.Response.Header.Peek("Access-Control-Allow-Private-Network")), "The Access-Control-Allow-Private-Network header should not be present by default")
+}
+
 // go test -v -run=^$ -bench=Benchmark_CORS_NewHandler -benchmem -count=4
 func Benchmark_CORS_NewHandler(b *testing.B) {
 	app := fiber.New()