Skip to content

Commit b5bb41f

Browse files
author
Arvind
committed
cors support
1 parent 1c3837c commit b5bb41f

File tree

12 files changed

+900
-0
lines changed

12 files changed

+900
-0
lines changed

‎app/code/Magento/GraphQl/Controller/Cors/HttpResponseHeaderProvider/AllowCredentialsHeaderProvider.php

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\GraphQl\Controller\Cors\HttpResponseHeaderProvider;
9+
10+
use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
11+
use Magento\GraphQl\Model\Cors\ConfigurationProviderInterface;
12+
use Magento\GraphQl\Model\Cors\Validator\RequestValidatorInterface;
13+
14+
/**
15+
* Provides value for Access-Control-Allow-Credentials header if CORS is enabled
16+
*/
17+
class AllowCredentialsHeaderProvider implements HeaderProviderInterface
18+
{
19+
/**
20+
* provides the allow credentials header value
21+
*/
22+
public const ALLOW_CREDENTIALS = "true";
23+
24+
/**
25+
* @var string
26+
*/
27+
private $headerName;
28+
29+
/**
30+
* CORS configuration provider
31+
*
32+
* @var ConfigurationProviderInterface
33+
*/
34+
private $corsConfiguration;
35+
36+
/**
37+
* @var RequestValidatorInterface
38+
*/
39+
private $requestValidator;
40+
41+
/**
42+
* @param ConfigurationProviderInterface $corsConfiguration
43+
* @param RequestValidatorInterface $requestValidator
44+
* @param string $headerName
45+
*/
46+
public function __construct(
47+
ConfigurationProviderInterface $corsConfiguration,
48+
RequestValidatorInterface $requestValidator,
49+
string $headerName
50+
) {
51+
$this->corsConfiguration = $corsConfiguration;
52+
$this->headerName = $headerName;
53+
$this->requestValidator = $requestValidator;
54+
}
55+
56+
/**
57+
* Get name of header
58+
*
59+
* @return string
60+
*/
61+
public function getName(): string
62+
{
63+
return $this->headerName;
64+
}
65+
66+
/**
67+
* Check if header can be applied
68+
*
69+
* @return bool
70+
*/
71+
public function canApply(): bool
72+
{
73+
return $this->requestValidator->isOriginAllowed() && $this->corsConfiguration->isCredentialsAllowed();
74+
}
75+
76+
/**
77+
* Get value for header
78+
*
79+
* @return string
80+
*/
81+
public function getValue(): string
82+
{
83+
return self::ALLOW_CREDENTIALS;
84+
}
85+
}

‎app/code/Magento/GraphQl/Controller/Cors/HttpResponseHeaderProvider/AllowHeadersHeaderProvider.php

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\GraphQl\Controller\Cors\HttpResponseHeaderProvider;
9+
10+
use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
11+
use Magento\GraphQl\Model\Cors\ConfigurationProviderInterface;
12+
use Magento\GraphQl\Model\Cors\Validator\RequestValidatorInterface;
13+
14+
/**
15+
* Provides value for Access-Control-Allow-Header header if CORS is enabled
16+
*/
17+
class AllowHeadersHeaderProvider implements HeaderProviderInterface
18+
{
19+
/**
20+
* @var string
21+
*/
22+
private $headerName;
23+
24+
/**
25+
* CORS configuration provider
26+
*
27+
* @var ConfigurationProviderInterface
28+
*/
29+
private $corsConfiguration;
30+
31+
/**
32+
* @var RequestValidatorInterface
33+
*/
34+
private $requestValidator;
35+
36+
/**
37+
* @param ConfigurationProviderInterface $corsConfiguration
38+
* @param RequestValidatorInterface $requestValidator
39+
* @param string $headerName
40+
*/
41+
public function __construct(
42+
ConfigurationProviderInterface $corsConfiguration,
43+
RequestValidatorInterface $requestValidator,
44+
string $headerName
45+
) {
46+
$this->corsConfiguration = $corsConfiguration;
47+
$this->headerName = $headerName;
48+
$this->requestValidator = $requestValidator;
49+
}
50+
51+
/**
52+
* Get name of header
53+
*
54+
* @return string
55+
*/
56+
public function getName(): string
57+
{
58+
return $this->headerName;
59+
}
60+
61+
/**
62+
* Check if header can be applied
63+
*
64+
* @return bool
65+
*/
66+
public function canApply(): bool
67+
{
68+
return $this->requestValidator->isOriginAllowed() && $this->getValue();
69+
}
70+
71+
/**
72+
* Get value for header
73+
*
74+
* @return string
75+
*/
76+
public function getValue(): string
77+
{
78+
return $this->corsConfiguration->getAllowedHeaders()
79+
? implode(',', $this->corsConfiguration->getAllowedHeaders())
80+
: '';
81+
}
82+
}

‎app/code/Magento/GraphQl/Controller/Cors/HttpResponseHeaderProvider/AllowMethodsHeaderProvider.php

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\GraphQl\Controller\Cors\HttpResponseHeaderProvider;
9+
10+
use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
11+
use Magento\GraphQl\Model\Cors\ConfigurationProviderInterface;
12+
use Magento\GraphQl\Model\Cors\Validator\RequestValidatorInterface;
13+
14+
/**
15+
* Provides value for Access-Control-Allow-Methods header if CORS is enabled
16+
*/
17+
class AllowMethodsHeaderProvider implements HeaderProviderInterface
18+
{
19+
/**
20+
* @var string
21+
*/
22+
private $headerName;
23+
24+
/**
25+
* @var string
26+
*/
27+
public const GRAPHQL_CORS_ALLOWED_METHODS = 'GET,POST,OPTIONS';
28+
29+
/**
30+
* CORS configuration provider
31+
*
32+
* @var ConfigurationProviderInterface
33+
*/
34+
private $corsConfiguration;
35+
36+
/**
37+
* @var RequestValidatorInterface
38+
*/
39+
private $requestValidator;
40+
41+
/**
42+
* @param ConfigurationProviderInterface $corsConfiguration
43+
* @param RequestValidatorInterface $requestValidator
44+
* @param string $headerName
45+
*/
46+
public function __construct(
47+
ConfigurationProviderInterface $corsConfiguration,
48+
RequestValidatorInterface $requestValidator,
49+
string $headerName
50+
) {
51+
$this->corsConfiguration = $corsConfiguration;
52+
$this->headerName = $headerName;
53+
$this->requestValidator = $requestValidator;
54+
}
55+
56+
/**
57+
* Get name of header
58+
*
59+
* @return string
60+
*/
61+
public function getName(): string
62+
{
63+
return $this->headerName;
64+
}
65+
66+
/**
67+
* Check if header can be applied
68+
*
69+
* @return bool
70+
*/
71+
public function canApply(): bool
72+
{
73+
return $this->requestValidator->isOriginAllowed() && $this->getValue();
74+
}
75+
76+
/**
77+
* Get value for header
78+
*
79+
* @return string
80+
*/
81+
public function getValue(): string
82+
{
83+
return $this->corsConfiguration->getAllowedMethods()
84+
? implode(',', $this->corsConfiguration->getAllowedMethods())
85+
: self::GRAPHQL_CORS_ALLOWED_METHODS;
86+
}
87+
}

‎app/code/Magento/GraphQl/Controller/Cors/HttpResponseHeaderProvider/AllowOriginHeaderProvider.php

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\GraphQl\Controller\Cors\HttpResponseHeaderProvider;
9+
10+
use Magento\Framework\App\RequestInterface;
11+
use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
12+
use Magento\GraphQl\Model\Cors\ConfigurationProviderInterface;
13+
use Magento\GraphQl\Model\Cors\Validator\RequestValidatorInterface;
14+
15+
/**
16+
* Provides value for Access-Control-Allow-Origin header if CORS is enabled
17+
*/
18+
class AllowOriginHeaderProvider implements HeaderProviderInterface
19+
{
20+
/**
21+
* @var string
22+
*/
23+
private $headerName;
24+
25+
/**
26+
* CORS configuration provider
27+
*
28+
* @var ConfigurationProviderInterface
29+
*/
30+
private $corsConfiguration;
31+
32+
/**
33+
* @var RequestInterface
34+
*/
35+
private $request;
36+
37+
/**
38+
* @var RequestValidatorInterface
39+
*/
40+
private $requestValidator;
41+
42+
/**
43+
* @param ConfigurationProviderInterface $corsConfiguration
44+
* @param RequestInterface $request
45+
* @param RequestValidatorInterface $requestValidator
46+
* @param string $headerName
47+
*/
48+
public function __construct(
49+
ConfigurationProviderInterface $corsConfiguration,
50+
RequestInterface $request,
51+
RequestValidatorInterface $requestValidator,
52+
string $headerName
53+
) {
54+
$this->corsConfiguration = $corsConfiguration;
55+
$this->headerName = $headerName;
56+
$this->request = $request;
57+
$this->requestValidator = $requestValidator;
58+
}
59+
60+
/**
61+
* Get name of header
62+
*
63+
* @return string
64+
*/
65+
public function getName(): string
66+
{
67+
return $this->headerName;
68+
}
69+
70+
/**
71+
* Check if header can be applied
72+
*
73+
* @return bool
74+
*/
75+
public function canApply(): bool
76+
{
77+
return $this->requestValidator->isOriginAllowed() && $this->getValue();
78+
}
79+
80+
public function getValue(): string
81+
{
82+
return $this->isAllOriginsAllowed() ? '*' : $this->request->getHeader('Origin');
83+
}
84+
85+
/**
86+
* if '*' is present, allow all origins
87+
*
88+
* @return bool
89+
*/
90+
private function isAllOriginsAllowed(): bool
91+
{
92+
return in_array('*', $this->corsConfiguration->getAllowedOrigins());
93+
}
94+
}

0 commit comments

Comments
 (0)