fix: add header and cli option

google · Aug 4, 2024 · 3cd4426 · 3cd4426
1 parent 87e319f
commit 3cd4426
Show file tree

Hide file tree

Showing 9 changed files with 71 additions and 31 deletions.
diff --git a/README.md b/README.md
@@ -872,3 +872,4 @@ tach http://example.com
 | `--trace`                   | `false`                                 | Enable performance tracing ([details](#performance-traces))                                                                                                        |
 | `--trace-log-dir`           | `${cwd}/logs`                           | The directory to put tracing log files. Defaults to `${cwd}/logs`.                                                                                                 |
 | `--trace-cat`               | [default categories](./src/defaults.ts) | The tracing categories to record. Should be a string of comma-separated category names                                                                             |
+| `--cross-origin-isolated`   | `false`                                 | Add HTTP headers to enable [cross-origin isolation](https://developer.mozilla.org/en-US/docs/Web/API/Window/crossOriginIsolated).                                  |
diff --git a/src/cli.ts b/src/cli.ts
@@ -162,6 +162,7 @@ $ tach http://example.com
           mountPoints,
           resolveBareModules: config.resolveBareModules,
           cache: config.mode !== 'manual',
+          crossOriginIsolated: config.crossOriginIsolated,
         });
         for (const spec of specs) {
           servers.set(spec, server);

diff --git a/src/config.ts b/src/config.ts
@@ -37,6 +37,7 @@ export interface Config {
   npmrc?: string;
   csvFileStats: string;
   csvFileRaw: string;
+  crossOriginIsolated: boolean;
 }
 
 export async function makeConfig(opts: Opts): Promise<Config> {
@@ -55,6 +56,7 @@ export async function makeConfig(opts: Opts): Promise<Config> {
       ? parseGithubCheckFlag(opts['github-check'])
       : undefined,
     remoteAccessibleHost: opts['remote-accessible-host'],
+    crossOriginIsolated: opts['cross-origin-isolated'],
   };
 
   let config: Config;
@@ -175,6 +177,10 @@ export function applyDefaults(partial: Partial<Config>): Config {
         : defaults.resolveBareModules,
     root: partial.root !== undefined ? partial.root : defaults.root,
     timeout: partial.timeout !== undefined ? partial.timeout : defaults.timeout,
+    crossOriginIsolated:
+      partial.crossOriginIsolated !== undefined
+        ? partial.crossOriginIsolated
+        : defaults.crossOriginIsolated,
   };
 }
 

diff --git a/src/cross-origin-isolation.ts b/src/cross-origin-isolation.ts
@@ -1,3 +1,8 @@
+/**
+ * @license
+ * Copyright 2024 Google LLC
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
 import {Middleware} from 'koa';
 
 // Enable cross-origin isolation for more precise timers:

diff --git a/src/defaults.ts b/src/defaults.ts
@@ -20,6 +20,7 @@ export const mode = 'automatic';
 export const resolveBareModules = true;
 export const forceCleanNpmInstall = false;
 export const measurementExpression = 'window.tachometerResult';
+export const crossOriginIsolated = false;
 export const traceLogDir = path.join(process.cwd(), 'logs');
 export const traceCategories = [
   'blink',

diff --git a/src/flags.ts b/src/flags.ts
@@ -266,6 +266,7 @@ export interface Opts {
   trace: boolean;
   'trace-log-dir': string;
   'trace-cat': string;
+  'cross-origin-isolated': boolean;
 
   // Extra arguments not associated with a flag are put here. These are our
   // benchmark names/URLs.

diff --git a/src/server.ts b/src/server.ts
@@ -19,7 +19,7 @@ import {nodeResolve} from 'koa-node-resolve';
 
 import {BenchmarkResponse, Deferred} from './types.js';
 import {NpmInstall} from './versions.js';
-import {crossOriginIsolation} from './cross-origin-isolation';
+import {crossOriginIsolation} from './cross-origin-isolation.js';
 
 import * as url from 'url';
 const __dirname = url.fileURLToPath(new URL('.', import.meta.url));
@@ -32,6 +32,7 @@ export interface ServerOpts {
   mountPoints: MountPoint[];
   resolveBareModules: boolean;
   cache: boolean;
+  crossOriginIsolated: boolean;
 }
 
 export interface MountPoint {
@@ -92,7 +93,9 @@ export class Server {
     this.server = server;
     const app = new Koa();
 
-    app.use(crossOriginIsolation());
+    if (opts.crossOriginIsolated) {
+      app.use(crossOriginIsolation());
+    }
     app.use(bodyParser());
     app.use(mount('/submitResults', this.submitResults.bind(this)));
     app.use(this.instrumentRequests.bind(this));

diff --git a/src/test/config_test.ts b/src/test/config_test.ts
@@ -46,6 +46,7 @@ suite('makeConfig', function () {
       csvFileStats: '',
       csvFileRaw: '',
       githubCheck: undefined,
+      crossOriginIsolated: false,
       benchmarks: [
         {
           browser: {
@@ -92,6 +93,7 @@ suite('makeConfig', function () {
       csvFileRaw: '',
       // TODO(aomarks) Be consistent about undefined vs unset.
       githubCheck: undefined,
+      crossOriginIsolated: false,
       benchmarks: [
         {
           browser: {
@@ -137,6 +139,7 @@ suite('makeConfig', function () {
       csvFileStats: '',
       csvFileRaw: '',
       githubCheck: undefined,
+      crossOriginIsolated: false,
       benchmarks: [
         {
           browser: {
@@ -190,6 +193,7 @@ suite('makeConfig', function () {
       remoteAccessibleHost: '',
       // TODO(aomarks) Be consistent about undefined vs unset.
       githubCheck: undefined,
+      crossOriginIsolated: false,
       benchmarks: [
         {
           browser: {
@@ -237,6 +241,7 @@ suite('makeConfig', function () {
       remoteAccessibleHost: '',
       // TODO(aomarks) Be consistent about undefined vs unset.
       githubCheck: undefined,
+      crossOriginIsolated: false,
       benchmarks: [
         {
           browser: {

diff --git a/src/test/server_test.ts b/src/test/server_test.ts
@@ -17,20 +17,25 @@ import {testData} from './test_helpers.js';
 suite('server', () => {
   let server: Server;
 
+  const defaultOptions = {
+    host: 'localhost',
+    ports: [0], // random
+    root: testData,
+    resolveBareModules: true,
+    npmInstalls: [],
+    mountPoints: [
+      {
+        diskPath: testData,
+        urlPath: '/',
+      },
+    ],
+    cache: true,
+    crossOriginIsolated: false,
+  };
+
   setup(async () => {
     server = await Server.start({
-      host: 'localhost',
-      ports: [0], // random
-      root: testData,
-      resolveBareModules: true,
-      npmInstalls: [],
-      mountPoints: [
-        {
-          diskPath: testData,
-          urlPath: '/',
-        },
-      ],
-      cache: true,
+      ...defaultOptions,
     });
   });
 
@@ -88,18 +93,8 @@ suite('server', () => {
       await server.close();
 
       server = await Server.start({
-        host: 'localhost',
-        ports: [0], // random
-        root: testData,
-        resolveBareModules: true,
+        ...defaultOptions,
         npmInstalls: [{installDir, packageJson}],
-        mountPoints: [
-          {
-            diskPath: testData,
-            urlPath: '/',
-          },
-        ],
-        cache: true,
       });
     });
 
@@ -138,13 +133,35 @@ suite('server', () => {
     assert.equal(session.bytesSent, 0);
   });
 
-  test('enables cross-origin isolation', async () => {
+  test('cross-origin isolation is disabled by default', async () => {
     const res = await fetch(`${server.url}/import-bare-module.html`);
 
-    assert.equal(res.headers.get('Cross-Origin-Opener-Policy'), 'same-origin');
-    assert.equal(
-      res.headers.get('Cross-Origin-Embedder-Policy'),
-      'require-corp'
-    );
+    assert.equal(res.headers.get('Cross-Origin-Opener-Policy'), null);
+    assert.equal(res.headers.get('Cross-Origin-Embedder-Policy'), null);
+  });
+
+  suite('cross origin isolation enabled', async () => {
+    setup(async () => {
+      // Close the base server and replace it with a custom server that is
+      // configured with crossOriginIsolated=true
+      await server.close();
+      server = await Server.start({
+        ...defaultOptions,
+        crossOriginIsolated: true,
+      });
+    });
+
+    test('cross-origin isolation can be enabled', async () => {
+      const res = await fetch(`${server.url}/import-bare-module.html`);
+
+      assert.equal(
+        res.headers.get('Cross-Origin-Opener-Policy'),
+        'same-origin'
+      );
+      assert.equal(
+        res.headers.get('Cross-Origin-Embedder-Policy'),
+        'require-corp'
+      );
+    });
   });
 });