CORS for PHP (using the Symfony HttpFoundation)
Library and middleware enabling cross-origin resource sharing for your http-{foundation,kernel} using application. It attempts to implement the W3C Recommendation for cross-origin resource sharing.
Note: This is a standalone fork of https://github.com/asm89/stack-cors and is compatible with the options for CorsService.
Installation
Require fruitcake/php-cors using composer.
Usage
This package can be used as a library. You can use it in your framework using:
- Stack middleware: https://github.com/asm89/stack-cors
- Laravel: https://github.com/fruitcake/laravel-cors
Options
| Option | Description | Default value |
|---|---|---|
| allowedMethods | Matches the request method. | [] |
| allowedOrigins | Matches the request origin. | [] |
| allowedOriginsPatterns | Matches the request origin with preg_match. |
[] |
| allowedHeaders | Sets the Access-Control-Allow-Headers response header. | [] |
| exposedHeaders | Sets the Access-Control-Expose-Headers response header. | [] |
| maxAge | Sets the Access-Control-Max-Age response header. | 0 |
| supportsCredentials | Sets the Access-Control-Allow-Credentials header. | false |
The allowedMethods and allowedHeaders options are case-insensitive.
You don't need to provide both allowedOrigins and allowedOriginsPatterns. If one of the strings passed matches, it is considered a valid origin. A wildcard in allowedOrigins will be converted to a pattern.
If ['*'] is provided to allowedMethods, allowedOrigins or allowedHeaders all methods / origins / headers are allowed.
Note: Allowing a single static origin will improve cacheability.
Example: using the library
<?php
use Fruitcake\Cors\CorsService;
$cors = new CorsService([
'allowedHeaders' => ['x-allowed-header', 'x-other-allowed-header'],
'allowedMethods' => ['DELETE', 'GET', 'POST', 'PUT'],
'allowedOrigins' => ['http://localhost', 'https://*.example.com'],
'allowedOriginsPatterns' => ['/localhost:\d/'],
'exposedHeaders' => ['Content-Encoding'],
'maxAge' => 0,
'supportsCredentials' => false,
]);
$cors->addActualRequestHeaders(Response $response, $origin);
$cors->handlePreflightRequest(Request $request);
$cors->isActualRequestAllowed(Request $request);
$cors->isCorsRequest(Request $request);
$cors->isPreflightRequest(Request $request);
License
Released under the MIT License, see LICENSE.
This package is split-off from https://github.com/asm89/stack-cors and developed as stand-alone library since 2022
29 Dec 27, 2022
92 Dec 18, 2022
720 Dec 25, 2022
84 Dec 21, 2022
283 Dec 15, 2022
199 Jan 3, 2023
35 Nov 17, 2022
6 Jul 5, 2022
7 Oct 20, 2022
10 Nov 12, 2022
1 May 22, 2022
0 Sep 15, 2022
88 Nov 5, 2022
804 Dec 19, 2022
2 Nov 19, 2021
4 Apr 19, 2022
23 Aug 28, 2022
8 May 6, 2022
369 Dec 22, 2022