About the HandleCors class in middleware

[haunv-be]

Hi everyone, I have an imperfect experience with this middleware.

• First, It is not really flexible in the work custom domain, and let's imagine that we have many domains and for each domain, I want to set values specified such as:
  origin 1: https://laravel.com => headers: x-header-one, x-header-two => methods: GET, HEAD, POST
  origin 2: https://php.net => headers: x-header-three, x-header-four => methods: POST, PUT, PATCH

• Second, It is not yet strict about methods sent by the cross-origin request. Default, the browser allowed safe methods such as GET, HEAD, or POST. If I have an API route such as: Route::put('users/{id}/edit', [UserController::class, 'edit'])
  If assume I send a cross-origin request to this route, I allow this request but I do not accept its method. Has a problem happened here, it was still sent but it was not prevented. Just to when it does not match the route method then it is stopped and the app throws an exception here.

Why is this middleware not preventing this request from the beginning?

I have a package that supports strongly for this middleware and I hope my package will apply your framework to it become more flexible and secure.

GitHub: https://github.com/haunv-be/php-cors