feat(web-server): add frame guard, CORS-friendly client headers, and websocket payload fixes

packages/nativescript-web-server/index.android.ts

@@ -4,8 +4,8 @@ export * from './common';
 
 export class Server {
 	private server;
-	constructor(config: { logger?: boolean; path: string; directory: string; index?: string; hostName?: string; port: number; workers?: number; showFiles?: boolean }) {
-		this.server = new io.nstudio.plugins.webserver.Server(config.logger ?? false, config.path, config.directory, config.index ?? null, config.hostName ?? '127.0.0.1', config.port ?? 8080, config.workers ?? 2, config.showFiles ?? false);
+	constructor(config: { logger?: boolean; path: string; directory: string; index?: string; hostName?: string; port: number; workers?: number; showFiles?: boolean; frameGuard?: boolean }) {
+		this.server = new io.nstudio.plugins.webserver.Server(config.logger ?? false, config.path, config.directory, config.index ?? null, config.hostName ?? '127.0.0.1', config.port ?? 8080, config.workers ?? 2, config.showFiles ?? false, config.frameGuard ?? false);
 	}
 
 	get status(): ServerStatus {
@@ -55,9 +55,19 @@ export class Server {
 
 export class Client {
 	_id: number;
+	/** Native websocket server, set at accept-time so header lookups can reach it. */
+	_server: io.nstudio.plugins.webserver.websocket.Server;
 	get id(): number {
 		return this._id;
 	}
+	/** `Origin` header from the upgrade request, or `null` if none was sent. */
+	get origin(): string | null {
+		return this.header('origin');
+	}
+	/** One upgrade-request header by name (case-insensitive), or `null`. */
+	header(name: string): string | null {
+		return this._server?.clientHeader(this._id, name) ?? null;
+	}
 }
 
 export class WebSocketServer extends Observable {
@@ -74,6 +84,7 @@ export class WebSocketServer extends Observable {
 					if (owner) {
 						const ret = new Client();
 						ret._id = id;
+						ret._server = owner.server;
 						owner.clients.set(id, ret);
 						owner.notify({ eventName: 'connection', client: ret });
 					}

packages/nativescript-web-server/index.d.ts

@@ -3,7 +3,7 @@ import { ServerStatus } from './common';
 export * from './common';
 export class Server {
 	private server: NSCServer;
-	constructor(config: { logger?: boolean; path: string; directory: string; index?: string; hostName?: string; port?: number; workers?: number; showFiles?: boolean });
+	constructor(config: { logger?: boolean; path: string; directory: string; index?: string; hostName?: string; port?: number; workers?: number; showFiles?: boolean; frameGuard?: boolean });
 
 	get status(): ServerStatus;
 
@@ -16,6 +16,14 @@ export class Server {
 
 export class Client {
 	readonly id: number;
+	/**
+	 * `Origin` header from the WebSocket upgrade request, or `null` when the
+	 * client sent none. Browsers always set it and cannot forge it, so it
+	 * can be used to allowlist connections from a known served origin.
+	 */
+	readonly origin: string | null;
+	/** One header value from the upgrade request (case-insensitive), or `null`. */
+	header(name: string): string | null;
 }
 
 export class WebSocketServer extends Observable {

packages/nativescript-web-server/index.ios.ts

@@ -4,8 +4,8 @@ export * from './common';
 
 export class Server {
 	private server: NSCServer;
-	constructor(config: { logger: boolean; path: string; directory: string; index: string; hostName: string; port: number; workers: number; showFiles?: boolean }) {
-		this.server = NSCServer.alloc().init(config.logger ?? false, config.path, config.directory, config.index ?? null, config.hostName ?? '127.0.0.1', config.port ?? 8080, config.workers ?? 2, config.showFiles ?? false);
+	constructor(config: { logger: boolean; path: string; directory: string; index: string; hostName: string; port: number; workers: number; showFiles?: boolean; frameGuard?: boolean }) {
+		this.server = NSCServer.alloc().init(config.logger ?? false, config.path, config.directory, config.index ?? null, config.hostName ?? '127.0.0.1', config.port ?? 8080, config.workers ?? 2, config.showFiles ?? false, config.frameGuard ?? false);
 	}
 
 	get status(): ServerStatus {
@@ -47,6 +47,14 @@ export class Client {
 	get id(): number {
 		return this._native.id;
 	}
+	/** `Origin` header from the upgrade request, or `null` if none was sent. */
+	get origin(): string | null {
+		return this._native.origin ?? null;
+	}
+	/** One upgrade-request header by name (case-insensitive), or `null`. */
+	header(name: string): string | null {
+		return this._native.header(name) ?? null;
+	}
 }
 
 export class WebSocketServer extends Observable {

packages/nativescript-web-server/platforms/ios/WebServerNative.xcframework/Info.plist

@@ -10,13 +10,12 @@
 			<key>DebugSymbolsPath</key>
 			<string>dSYMs</string>
 			<key>LibraryIdentifier</key>
-			<string>ios-arm64_x86_64-simulator</string>
+			<string>ios-arm64-simulator</string>
 			<key>LibraryPath</key>
 			<string>WebServerNative.framework</string>
 			<key>SupportedArchitectures</key>
 			<array>
 				<string>arm64</string>
-				<string>x86_64</string>
 			</array>
 			<key>SupportedPlatform</key>
 			<string>ios</string>