0

Final Class Yiisoft\HttpMiddleware\CorsAllowAllMiddleware

All Classes | Methods
InheritanceYiisoft\HttpMiddleware\CorsAllowAllMiddleware
ImplementsPsr\Http\Server\MiddlewareInterface

Adds Cross-Origin Resource Sharing (CORS) headers allowing everything to the response.

Security notice. This middleware should not be used in production as-is unless you're absolutely certain it's safe for your context. Allowing all origins and credentials without restriction poses a serious security risk.

See also https://developer.mozilla.org/docs/Web/HTTP/Guides/CORS.

Public Methods

Hide inherited methods

Method Description Defined By
__construct() Yiisoft\HttpMiddleware\CorsAllowAllMiddleware
process() Yiisoft\HttpMiddleware\CorsAllowAllMiddleware

Method Details

Hide inherited methods

__construct() public method

public mixed __construct ( \Psr\Http\Message\ResponseFactoryInterface|null $responseFactory = null )
$responseFactory \Psr\Http\Message\ResponseFactoryInterface|null

Factory used to short-circuit preflight requests.

 

                public function __construct(
    private readonly ?ResponseFactoryInterface $responseFactory = null,
) {}
process() public method

public \Psr\Http\Message\ResponseInterface process ( \Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Server\RequestHandlerInterface $handler )
$request \Psr\Http\Message\ServerRequestInterface
$handler \Psr\Http\Server\RequestHandlerInterface 

                public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
{
    $origins = $request->getHeader('Origin');
    $origin = count($origins) === 1 ? $origins[0] : '';
    $isPreflight = $request->getMethod() === 'OPTIONS'
        && $request->getHeaderLine('Access-Control-Request-Method') !== '';
    $response = $isPreflight && $this->responseFactory !== null
        ? $this->responseFactory->createResponse(204)
        : $handler->handle($request);
    $exposedHeaders = [];
    /** @var array<string, string[]> $headers */
    $headers = $response->getHeaders();
    foreach ($headers as $name => $_) {
        if (strtolower($name) !== 'set-cookie') {
            $exposedHeaders[] = $name;
        }
    }
    $vary = array_map(trim(...), explode(',', strtolower($response->getHeaderLine('Vary'))));
    if (!in_array('origin', $vary, true)) {
        $response = $response->withAddedHeader('Vary', 'Origin');
    }
    $response = $response
        ->withHeader('Access-Control-Allow-Origin', $origin === '' ? '*' : $origin)
        ->withHeader('Access-Control-Allow-Methods', 'GET,OPTIONS,HEAD,POST,PUT,PATCH,DELETE')
        ->withHeader('Access-Control-Max-Age', '86400');
    if ($origin === '') {
        return $response
            ->withHeader('Access-Control-Allow-Headers', '*')
            ->withHeader('Access-Control-Expose-Headers', '*');
    }
    $requestedHeaders = $request->getHeaderLine('Access-Control-Request-Headers');
    if ($requestedHeaders !== '') {
        $response = $response->withHeader('Access-Control-Allow-Headers', $requestedHeaders);
    }
    if ($exposedHeaders !== []) {
        $response = $response->withHeader('Access-Control-Expose-Headers', implode(',', $exposedHeaders));
    }
    return $response->withHeader('Access-Control-Allow-Credentials', 'true');
}