leafsphp/cors

🔖 CORS module for leaf + PHP

Leaf Cors Module

Leaf PHP

This is a Leaf PHP module used to enable and configure CORS with various options. This module can be used both in and out of Leaf and so can be considered a general module. It is also inspired by the ExpressJS cors package.

Installation

You can easily install it using leaf cli

leaf install cors

or with Composer:

composer require leafs/cors

Usage

After installing the cors module, the cors module is automatically linked to the leaf app and can be used directly without referencing it anywhere.

Simple Usage (Enable All CORS Requests)

require __DIR__ . "/vendor/autoload.php";

$app = new Leaf\App;

$app->cors();

$app->get('/products/{id}', function () use($app) {
  $app->response()->json(['message' => 'This is CORS-enabled for all origins!']);
});

$app->run();

You can alternatively call Leaf\Http\Cors::config() instead of $app->cors() in the example above.

Configuring CORS

require __DIR__ . '/vendor/autoload.php';

$app = new Leaf\App;

$app->cors([
  'origin' => 'http://example.com',
  'optionsSuccessStatus' => 200 // some legacy browsers (IE11, various SmartTVs) choke on 204
]);

$app->get('/products/{id}', function () use($app) {
  $app->response()->json(['message' => 'This is CORS-enabled for all origins!']);
});

$app->run();

Configuration Options

• origin: Configures the Access-Control-Allow-Origin CORS header. Possible values:
  • String - set origin to a specific origin. For example if you set it to "http://example.com" only requests from "http://example.com" will be allowed.
  • RegExp (in string form) - set origin to a regular expression pattern which will be used to test the request origin. If it's a match, the request origin will be reflected. For example the pattern '/example\.com$/' will reflect any request that is coming from an origin ending with "example.com".
  • Array - set origin to an array of valid origins. Each origin can be a String or a RegExp. For example ["http://example1.com", '/\.example2\.com$/'] will accept any request from "http://example1.com" or from a subdomain of "example2.com".
  • Function - set origin to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (called as callback(err, origin), where origin is a non-function value of the origin option) as the second.
• methods: Configures the Access-Control-Allow-Methods CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: ['GET', 'PUT', 'POST']).
• allowedHeaders: Configures the Access-Control-Allow-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: ['Content-Type', 'Authorization']). If not specified, defaults to reflecting the headers specified in the request's Access-Control-Request-Headers header.
• exposedHeaders: Configures the Access-Control-Expose-Headers CORS header. Expects a comma-delimited string (ex: 'Content-Range,X-Content-Range') or an array (ex: ['Content-Range', 'X-Content-Range']). If not specified, no custom headers are exposed.
• credentials: Configures the Access-Control-Allow-Credentials CORS header. Set to true to pass the header, otherwise it is omitted.
• maxAge: Configures the Access-Control-Max-Age CORS header. Set to an integer to pass the header, otherwise it is omitted.
• preflightContinue: Pass the CORS preflight response to the next handler.
• optionsSuccessStatus: Provides a status code to use for successful OPTIONS requests, since some legacy browsers (IE11, various SmartTVs) choke on 204.

The default configuration is the equivalent of:

{
  "origin": "*",
  "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
  "allowedHeaders": "*",
  "exposedHeaders": "",
  "credentials": false,
  "maxAge": null,
  "preflightContinue": false,
  "optionsSuccessStatus": 204,
}

View Leaf's docs here

Built with ❤ by Mychi Darko

cors's Issues

preg_match throwing error in CORS module

CORS code

app()->cors([ "origin" => 'http://example.com', "optionsSuccessStatus" => 200 // some legacy browsers (IE11, various SmartTVs) choke on 204 ]);

Screenshot

allowedHeaders configuration doesn't change

Hi, I changed the cors config file in LEAF API with the following:

'methods' => 'GET,PUT,POST,DELETE,OPTIONS',
'allowedHeaders' => 'Content-Type,Authorization',
'credentials' => true,

/* ... Other default configuration */

But the Access-Control-Allow-Headers header in preflight request doesn't change, it always has '*' value (default configuration).

This is the response headers:

I'm changing the default configuration for use cookies, I don't know if there is other way.

I hope you can help me, thanks.

No 'Access-Control-Allow-Origin'

https://github.com/leafsphp/cors/blob/10934a7504879ecf9b6f7687926c22a3b5c02ce9/src/Cors.php#LL71C4-L71C4

There is an error here.
If we want to set a custom Allow-Origin, we won't be able to do it.
For example, if I want to set the value "*", it will still not be accepted. The AJAX request will throw an error:
...has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

ErrorException thrown with message "Undefined index: HTTP_ORIGIN"

ISSUE:
After creating a default leaf mvc project, then attempting to view the project the user receives a notice exception.

EXCEPTION DETAILS
Leaf\Exceptions\ErrorException thrown with message "Undefined index: HTTP_ORIGIN"

Stacktrace:
#6 Leaf\Exceptions\ErrorException in vendor/leafs/cors/src/Cors.php:129
#5 Leaf\Exception\Run:handleError in vendor/leafs/cors/src/Cors.php:129
#4 Leaf\Http\Cors:isOriginAllowed in vendor/leafs/cors/src/Cors.php:68
#3 Leaf\Http\Cors:configureOrigin in vendor/leafs/cors/src/Cors.php:33
#2 Leaf\Http\Cors:config in vendor/leafs/leaf/src/App.php:385
#1 Leaf\App:cors in public/index.php:100
#0 require_once in index.php:24

STEPS TO REPRODUCE:

1. Create a Leaf MVC project with the command "composer create-project leafs/mvc v3.x-dev"
2. Start project with "php leaf serve"
3. View the project in Google Chrome, the user is shown a notice exception.