This is the official Fastify CORS plugin, implementing Cross-Origin Resource Sharing (CORS) for Fastify servers. It provides comprehensive configuration for all standard CORS headers, including origin (string, regex, array, boolean, or dynamic function), methods, allowed headers, exposed headers, credentials, max age, cache control, and preflight handling. The architecture is a standard Fastify plugin that registers a configurable lifecycle hook (default onRequest) and a wildcard OPTIONS route to handle preflight requests. It supports dynamic configuration via a delegator callback or promise, and per-route CORS overrides via route config. The code is well-structured, thoroughly tested, and includes a particularly well-crafted `vary.js` module for managing the Vary header with caching. Dependencies are minimal and up to date.
Nuxt Security is a Nuxt 3+ module that automatically configures applications to follow OWASP security patterns through HTTP headers and middleware. It provides security response headers (including CSP with nonce/hash support for SSR/SSG), request size and rate limiting, XSS validation, CORS support, and optional features like Basic Auth and CSRF protection. The architecture uses Nitro plugins to integrate with Nuxt's server lifecycle, separating concerns between configuration, middleware, build-time plugins, and runtime hooks. The module handles both SSR and SSG modes appropriately, using nonces for CSP in SSR and computed hashes for SSG, with proper strict-dynamic support.
Ladder is a self-hosted HTTP web proxy written in Go, designed for testing and analyzing paywall implementations, content delivery, and access control behavior on modern websites. It intercepts client requests, applies domain-specific YAML rulesets to modify request headers, URLs, and response content (e.g., removing CORS/CSP headers, injecting scripts, rewriting relative URLs), then fetches the target site and returns the modified response. The proxy exposes a web form, a JSON API, a raw HTML endpoint, and a ruleset endpoint, and supports optional FlareSolverr integration for bypassing Cloudflare challenges. It is deployable as a binary, Docker container, or Helm chart, and is configured via environment variables and CLI flags. The architecture is a single Go binary using the Fiber web framework. The main entry point (cmd/main.go) sets up routing, basic auth, and middleware. Core logic lives in handlers/proxy.go, which handles URL extraction, ruleset application, HTTP fetching, HTML rewriting, and FlareSolverr integration. The pkg/ruleset package provides a clean, reusable ruleset loader supporting local files, directories, remote URLs, and gzip-compressed YAML. The codebase is generally well-structured with some global state and a few misnamed test files (e.g., proxy.test.go instead of proxy_test.go) that are not executed by Go's test runner. Despite these minor issues, the project is actively maintained, uses current dependencies, and demonstrates solid engineering practices for a focused tool.
This is a Symfony bundle that adds Cross-Origin Resource Sharing (CORS) headers to HTTP responses and handles CORS preflight OPTIONS requests. It intercepts kernel request and response events, applies configurable per-URL rules (origin matching, allowed methods/headers, credentials, private network access, forced origin values, etc.), and automatically adds a `Vary: Origin` header to cacheable responses. The bundle is well-structured with a clean provider/resolver pattern for configuration, supports Symfony 5.4 through 8.0 and PHP 7.2+, and includes full CI and static analysis. It is a mature, actively maintained library that solves a specific HTTP security concern in a robust and extensible manner.