security -> origin matching

README.md

@@ -43,6 +43,11 @@ oauth.authorize_path=/oauth/authorize
 oauth.token_path=/oauth/token
 ```
 
+For security reasons set an origin_pattern to match the origins, so that only trusted origins could be use to authenticate. Replace yoursite.com with your domain.
+```
+firebase functions:config:set oauth.origin_pattern="(^https://yoursite.com$|^https://www.yoursite.com$|^http://localhost:3000$)"
+```
+
 ### 4) Deploy the function
 Deploy the function to Firebase:
 ```

firebase.json

@@ -1 +1,7 @@
-{}
+{
+  "functions": {
+    "predeploy": [
+      "npm --prefix \"$RESOURCE_DIR\" run lint"
+    ]
+  }
+}

functions/.eslintrc.json

@@ -1,7 +1,7 @@
 {
   "parserOptions": {
     // Required for certain syntax usages
-    "ecmaVersion": 6
+    "ecmaVersion": 8
   },
   "plugins": [
     "promise"

functions/.gitignore

@@ -0,0 +1 @@
+node_modules/

functions/index.js

@@ -11,6 +11,11 @@ function getScript(mess, content) {
   (function() {
     function receiveMessage(e) {
       console.log("receiveMessage %o", e)
+      if (!e.origin.match(${JSON.stringify(oauth.origin_pattern,"i")})) {
+          console.log('Invalid origin: %s', e.origin);
+          window.close();
+          return;
+        }
       window.opener.postMessage(
         'authorization:github:${mess}:${JSON.stringify(content)}',
         e.origin
@@ -49,6 +54,10 @@ oauthApp.get('/auth', (req, res) => {
 })
 
 oauthApp.get('/callback', async (req, res) => {
+  if(''.match(oauth.origin_pattern || '')){
+    console.error("Insecure ORIGIN pattern used. This can give unauthorized users access to your repository.");
+    process.exit();
+  }
   var options = {
     code: req.query.code
   }
@@ -73,6 +82,7 @@ oauthApp.get('/callback', async (req, res) => {
     console.error('Access Token Error', error.message)
     res.send(getScript('error', error))
   }
+  return 'Error';
 })
 
 oauthApp.get('/success', (req, res) => {

functions/package.json

@@ -2,7 +2,7 @@
   "name": "functions",
   "description": "Cloud Functions for Firebase",
   "engines": {
-    "node": "10"
+    "node": "12"
   },
   "scripts": {
     "lint": "eslint .",