Commit 62cc1256 authored by Karamel's avatar Karamel
Browse files

Update CORS headers management to use them only when required.

parent 183f4e63
......@@ -9,11 +9,7 @@ $corsMiddleware = function($request, $response, $next) {
// Pass the call to the regular route
$response = $next($request, $response);
if (!APICaller::isAllowedOrigin($request->getHeader('Origin'),
$ptApp->getAllowedOrigin())) {
return $response->withResponse(403, 'Forbidden');
}
// Set CORS headers
// Set CORS headers if required
$headers = APICaller::getCORSHeaders($request->getHeader('Origin'),
$ptApp->getAllowedOrigin());
foreach ($headers as $header => $value) {
......
......@@ -104,6 +104,9 @@ class APICaller {
/** Get HTTP headers to allow a cross origin request. */
public static function getCORSHeaders($origin, $allowedOrigins, $maxAge = 86400) {
$headers = [];
if (!static::isAllowedOrigin($origin, $allowedOrigins)) {
return $headers;
}
$headers['Access-Control-Allow-Origin'] = $origin;
$headers['Access-Control-Allow-Credentials'] = false;
$headers['Access-Control-Max-Age'] = $maxAge;
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment