18
18
19
19
/**
20
20
* @phpstan-type CorsInputOptions array{
21
- * 'allowedOrigins'?: array{ string}|array{} ,
22
- * 'allowedOriginsPatterns'?: array{ string}|array{} ,
21
+ * 'allowedOrigins'?: string[] ,
22
+ * 'allowedOriginsPatterns'?: string[] ,
23
23
* 'supportsCredentials'?: bool,
24
- * 'allowedHeaders'?: array{ string}|array{} ,
25
- * 'allowedMethods'?: array{ string}|array{} ,
26
- * 'exposedHeaders'?: array{ string}|array{} ,
24
+ * 'allowedHeaders'?: string[] ,
25
+ * 'allowedMethods'?: string[] ,
26
+ * 'exposedHeaders'?: string[]|false ,
27
27
* 'maxAge'?: int|bool|null,
28
- * 'allowed_origins'?: array{ string}|array{} ,
29
- * 'allowed_origins_patterns'?: array{ string}|array{} ,
28
+ * 'allowed_origins'?: string[] ,
29
+ * 'allowed_origins_patterns'?: string[] ,
30
30
* 'supports_credentials'?: bool,
31
- * 'allowed_headers'?: array{ string}|array{} ,
32
- * 'allowed_methods'?: array{ string}|array{} ,
33
- * 'exposed_headers'?: array{ string}|array{} ,
31
+ * 'allowed_headers'?: string[] ,
32
+ * 'allowed_methods'?: string[] ,
33
+ * 'exposed_headers'?: string[]|false ,
34
34
* 'max_age'?: int|bool|null
35
35
* }
36
36
*
37
37
* @phpstan-type CorsNormalizedOptions array{
38
- * 'allowedOrigins': array{ string}|array{}|true ,
39
- * 'allowedOriginsPatterns': array{ string}|array{} ,
38
+ * 'allowedOrigins': string[] ,
39
+ * 'allowedOriginsPatterns': string[] ,
40
40
* 'supportsCredentials': bool,
41
- * 'allowedHeaders': array{string}|array{}|bool,
42
- * 'allowedMethods': array{string}|array{}|bool,
43
- * 'exposedHeaders': array{string}|array{},
44
- * 'maxAge': int|bool|null
41
+ * 'allowedHeaders': string[],
42
+ * 'allowedMethods': string[],
43
+ * 'exposedHeaders': string[],
44
+ * 'maxAge': int|bool|null,
45
+ * 'allowAllOrigins': bool,
46
+ * 'allowAllHeaders': bool,
47
+ * 'allowAllMethods': bool,
45
48
* }
46
49
*/
47
50
class CorsService
@@ -63,34 +66,18 @@ public function __construct(array $options = [])
63
66
*/
64
67
private function normalizeOptions (array $ options = []): array
65
68
{
66
- $ aliases = [
67
- 'supports_credentials ' => 'supportsCredentials ' ,
68
- 'allowed_origins ' => 'allowedOrigins ' ,
69
- 'allowed_origins_patterns ' => 'allowedOriginsPatterns ' ,
70
- 'allowed_headers ' => 'allowedHeaders ' ,
71
- 'allowed_methods ' => 'allowedMethods ' ,
72
- 'exposed_headers ' => 'exposedHeaders ' ,
73
- 'max_age ' => 'maxAge ' ,
74
- ];
75
-
76
- // Normalize underscores
77
- foreach ($ aliases as $ alias => $ option ) {
78
- if (isset ($ options [$ alias ])) {
79
- $ options [$ option ] = $ options [$ alias ];
80
- unset($ options [$ alias ]);
81
- }
69
+ $ options ['allowedOrigins ' ] = $ options ['allowedOrigins ' ] ?? $ options ['allowed_origins ' ] ?? [];
70
+ $ options ['allowedOriginsPatterns ' ] =
71
+ $ options ['allowedOriginsPatterns ' ] ?? $ options ['allowed_origins_patterns ' ] ?? [];
72
+ $ options ['allowedMethods ' ] = $ options ['allowedMethods ' ] ?? $ options ['allowed_methods ' ] ?? [];
73
+ $ options ['allowedHeaders ' ] = $ options ['allowedHeaders ' ] ?? $ options ['allowed_headers ' ] ?? [];
74
+ $ options ['exposedHeaders ' ] = $ options ['exposedHeaders ' ] ?? $ options ['exposed_headers ' ] ?? [];
75
+ $ options ['supportsCredentials ' ] = $ options ['supportsCredentials ' ] ?? $ options ['supports_credentials ' ] ?? false ;
76
+
77
+ if (!array_key_exists ('maxAge ' , $ options )) {
78
+ $ options ['maxAge ' ] = array_key_exists ('max_age ' , $ options ) ? $ options ['max_age ' ] : 0 ;
82
79
}
83
80
84
- $ options += [
85
- 'allowedOrigins ' => [],
86
- 'allowedOriginsPatterns ' => [],
87
- 'supportsCredentials ' => false ,
88
- 'allowedHeaders ' => [],
89
- 'exposedHeaders ' => [],
90
- 'allowedMethods ' => [],
91
- 'maxAge ' => 0 ,
92
- ];
93
-
94
81
if ($ options ['exposedHeaders ' ] === false ) {
95
82
$ options ['exposedHeaders ' ] = [];
96
83
}
@@ -115,21 +102,14 @@ private function normalizeOptions(array $options = []): array
115
102
}
116
103
}
117
104
118
- // normalize array('*') to true
119
- if (in_array ('* ' , $ options ['allowedOrigins ' ])) {
120
- $ options ['allowedOrigins ' ] = true ;
121
- }
122
- if (in_array ('* ' , $ options ['allowedHeaders ' ])) {
123
- $ options ['allowedHeaders ' ] = true ;
124
- } else {
125
- $ options ['allowedHeaders ' ] = array_map ('strtolower ' , $ options ['allowedHeaders ' ]);
126
- }
105
+ // Normalize case
106
+ $ options ['allowedHeaders ' ] = array_map ('strtolower ' , $ options ['allowedHeaders ' ]);
107
+ $ options ['allowedMethods ' ] = array_map ('strtoupper ' , $ options ['allowedMethods ' ]);
127
108
128
- if (in_array ('* ' , $ options ['allowedMethods ' ])) {
129
- $ options ['allowedMethods ' ] = true ;
130
- } else {
131
- $ options ['allowedMethods ' ] = array_map ('strtoupper ' , $ options ['allowedMethods ' ]);
132
- }
109
+ // Normalize ['*'] to true
110
+ $ options ['allowAllOrigins ' ] = in_array ('* ' , $ options ['allowedOrigins ' ]);
111
+ $ options ['allowAllHeaders ' ] = in_array ('* ' , $ options ['allowedHeaders ' ]);
112
+ $ options ['allowAllMethods ' ] = in_array ('* ' , $ options ['allowedMethods ' ]);
133
113
134
114
return $ options ;
135
115
}
@@ -191,7 +171,7 @@ public function addPreflightRequestHeaders(Response $response, Request $request)
191
171
192
172
public function isOriginAllowed (Request $ request ): bool
193
173
{
194
- if ($ this ->options ['allowedOrigins ' ] === true ) {
174
+ if ($ this ->options ['allowAllOrigins ' ] === true ) {
195
175
return true ;
196
176
}
197
177
@@ -205,6 +185,7 @@ public function isOriginAllowed(Request $request): bool
205
185
return true ;
206
186
}
207
187
188
+ /** @var string $pattern */
208
189
foreach ($ this ->options ['allowedOriginsPatterns ' ] as $ pattern ) {
209
190
if (preg_match ($ pattern , $ origin )) {
210
191
return true ;
@@ -229,7 +210,7 @@ public function addActualRequestHeaders(Response $response, Request $request): R
229
210
230
211
private function configureAllowedOrigin (Response $ response , Request $ request ): void
231
212
{
232
- if ($ this ->options ['allowedOrigins ' ] === true && !$ this ->options ['supportsCredentials ' ]) {
213
+ if ($ this ->options ['allowAllOrigins ' ] === true && !$ this ->options ['supportsCredentials ' ]) {
233
214
// Safe+cacheable, allow everything
234
215
$ response ->headers ->set ('Access-Control-Allow-Origin ' , '* ' );
235
216
} elseif ($ this ->isSingleOriginAllowed ()) {
@@ -247,7 +228,7 @@ private function configureAllowedOrigin(Response $response, Request $request): v
247
228
248
229
private function isSingleOriginAllowed (): bool
249
230
{
250
- if ($ this ->options ['allowedOrigins ' ] === true || count ($ this ->options ['allowedOriginsPatterns ' ]) > 0 ) {
231
+ if ($ this ->options ['allowAllOrigins ' ] === true || count ($ this ->options ['allowedOriginsPatterns ' ]) > 0 ) {
251
232
return false ;
252
233
}
253
234
@@ -256,8 +237,8 @@ private function isSingleOriginAllowed(): bool
256
237
257
238
private function configureAllowedMethods (Response $ response , Request $ request ): void
258
239
{
259
- if ($ this ->options ['allowedMethods ' ] === true ) {
260
- $ allowMethods = strtoupper ($ request ->headers ->get ('Access-Control-Request-Method ' ));
240
+ if ($ this ->options ['allowAllMethods ' ] === true ) {
241
+ $ allowMethods = strtoupper (( string ) $ request ->headers ->get ('Access-Control-Request-Method ' ));
261
242
$ this ->varyHeader ($ response , 'Access-Control-Request-Method ' );
262
243
} else {
263
244
$ allowMethods = implode (', ' , $ this ->options ['allowedMethods ' ]);
@@ -268,7 +249,7 @@ private function configureAllowedMethods(Response $response, Request $request):
268
249
269
250
private function configureAllowedHeaders (Response $ response , Request $ request ): void
270
251
{
271
- if ($ this ->options ['allowedHeaders ' ] === true ) {
252
+ if ($ this ->options ['allowAllHeaders ' ] === true ) {
272
253
$ allowHeaders = $ request ->headers ->get ('Access-Control-Request-Headers ' );
273
254
$ this ->varyHeader ($ response , 'Access-Control-Request-Headers ' );
274
255
} else {
@@ -302,8 +283,8 @@ public function varyHeader(Response $response, string $header): Response
302
283
{
303
284
if (!$ response ->headers ->has ('Vary ' )) {
304
285
$ response ->headers ->set ('Vary ' , $ header );
305
- } elseif (!in_array ($ header , explode (', ' , $ response ->headers ->get ('Vary ' )))) {
306
- $ response ->headers ->set ('Vary ' , $ response ->headers ->get ('Vary ' ) . ', ' . $ header );
286
+ } elseif (!in_array ($ header , explode (', ' , ( string ) $ response ->headers ->get ('Vary ' )))) {
287
+ $ response ->headers ->set ('Vary ' , (( string ) $ response ->headers ->get ('Vary ' ) ) . ', ' . $ header );
307
288
}
308
289
309
290
return $ response ;
0 commit comments