如何在Netlify Function中强制同源CORS策略 阻止非指定来源请求

你目前仅配置了Access-Control-Allow-Origin响应头，这个规则属于浏览器的跨域安全限制，仅会被浏览器遵守，curl、Postman这类非浏览器客户端完全不会校验该响应头，因此不管怎么设置CORS参数，都拦不住这类工具的直接请求。

• 在业务逻辑执行前新增请求来源校验，检查请求头中的Origin是否匹配process.env.URL，不匹配直接返回403状态码拒绝请求
• 补充OPTIONS预检请求的处理逻辑，避免浏览器跨域请求时出现异常
• 新增非法请求方法的拦截逻辑，减少异常请求的影响

exports.handler = async (event, context, callback) => {  
  try {
    // 处理浏览器跨域预检请求
    if (event.httpMethod === 'OPTIONS') {
      return {
        statusCode: 204,
        headers: {
          "Access-Control-Allow-Origin": process.env.URL,
          "Access-Control-Allow-Headers": "Origin, X-Requested-With, Content-Type, Accept",
          "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
          "Content-Type": "application/json",
        },
        body: ''
      }
    }

    // 校验请求来源是否合法
    const allowedOrigin = process.env.URL
    const requestOrigin = event.headers.origin || event.headers.Origin
    if (requestOrigin !== allowedOrigin) {
      return {
        statusCode: 403,
        headers: {
          "Content-Type": "application/json",
        },
        body: JSON.stringify({ error: "Forbidden: Invalid request source" })
      }
    }

    let id = event.rawUrl.split("/").pop();
    let response;
    switch (event.httpMethod) {
      case "GET":
        response = await prisma.like.count({ where: { postId: parseInt(id) } });
        break;
      case "POST":
        response = await prisma.like.create({
          data: { postId: parseInt(id) },
        });
        break;
      case "DELETE":
        response = await prisma.like.delete({
          where: {
            id: parseInt(id),
          },
        });
        break;
      // 拦截非法请求方法
      default:
        return {
          statusCode: 405,
          body: JSON.stringify({ error: "Method Not Allowed" })
        }
    }
    callback(null, {
      statusCode: 200,
      headers: {
        "Access-Control-Allow-Origin": process.env.URL,
        "Access-Control-Allow-Headers":
          "Origin, X-Requested-With, Content-Type, Accept",
        "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
        "Content-Type": "application/json",
      },
      body: JSON.stringify(response),
    });
    return;
  } catch (e) {
    console.error(e);
    return { statusCode: 500 };
  }
};

• Origin、Referer请求头可以人为伪造，该方案仅能拦截普通的跨站请求和无针对性的工具调用，如果需要更高的安全等级，建议额外添加接口签名、CSRF Token校验逻辑
• 请确保Netlify环境变量中URL已正确配置为你的站点域名，包含http/https前缀

内容的提问来源于stack exchange，提问作者InterstellarBrandon