Skip to content
GitLab
Menu
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
SAMBUMBA
pasteque-server
Commits
62cc1256
Commit
62cc1256
authored
Dec 12, 2017
by
Karamel
Browse files
Update CORS headers management to use them only when required.
parent
183f4e63
Changes
2
Hide whitespace changes
Inline
Side-by-side
src/http/middlewares/cors_middleware.php
View file @
62cc1256
...
...
@@ -9,11 +9,7 @@ $corsMiddleware = function($request, $response, $next) {
// Pass the call to the regular route
$response
=
$next
(
$request
,
$response
);
if
(
!
APICaller
::
isAllowedOrigin
(
$request
->
getHeader
(
'Origin'
),
$ptApp
->
getAllowedOrigin
()))
{
return
$response
->
withResponse
(
403
,
'Forbidden'
);
}
// Set CORS headers
// Set CORS headers if required
$headers
=
APICaller
::
getCORSHeaders
(
$request
->
getHeader
(
'Origin'
),
$ptApp
->
getAllowedOrigin
());
foreach
(
$headers
as
$header
=>
$value
)
{
...
...
src/lib/System/API/APICaller.php
View file @
62cc1256
...
...
@@ -104,6 +104,9 @@ class APICaller {
/** Get HTTP headers to allow a cross origin request. */
public
static
function
getCORSHeaders
(
$origin
,
$allowedOrigins
,
$maxAge
=
86400
)
{
$headers
=
[];
if
(
!
static
::
isAllowedOrigin
(
$origin
,
$allowedOrigins
))
{
return
$headers
;
}
$headers
[
'Access-Control-Allow-Origin'
]
=
$origin
;
$headers
[
'Access-Control-Allow-Credentials'
]
=
false
;
$headers
[
'Access-Control-Max-Age'
]
=
$maxAge
;
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment