Skip to content

Commit b79c484

Browse files
michalderlatkamichalderlatka
committed
#28561: GraphQL added CORS headers
1 parent 50635d9 commit b79c484

File tree

10 files changed

+243
-41
lines changed

10 files changed

+243
-41
lines changed

‎app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowCredentialsHeaderProvider.php

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,21 @@
11
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
27

38
namespace Magento\GraphQl\Controller\HttpResponse\Cors;
49

510
use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
611
use Magento\GraphQl\Model\Cors\ConfigurationInterface;
712

13+
/**
14+
* Provides value for Access-Control-Allow-Credentials header if CORS is enabled
15+
*/
816
class CorsAllowCredentialsHeaderProvider implements HeaderProviderInterface
917
{
10-
protected $headerName = 'Access-Control-Allow-Credentials';
18+
private $headerName;
1119

1220
/**
1321
* CORS configuration provider
@@ -16,9 +24,12 @@ class CorsAllowCredentialsHeaderProvider implements HeaderProviderInterface
1624
*/
1725
private $corsConfiguration;
1826

19-
public function __construct(ConfigurationInterface $corsConfiguration)
20-
{
27+
public function __construct(
28+
ConfigurationInterface $corsConfiguration,
29+
string $headerName
30+
) {
2131
$this->corsConfiguration = $corsConfiguration;
32+
$this->headerName = $headerName;
2233
}
2334

2435
public function getName()

‎app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowHeadersHeaderProvider.php

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,21 @@
11
<?php
2-
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
37

48
namespace Magento\GraphQl\Controller\HttpResponse\Cors;
59

610
use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
711
use Magento\GraphQl\Model\Cors\ConfigurationInterface;
812

13+
/**
14+
* Provides value for Access-Control-Allow-Headers header if CORS is enabled
15+
*/
916
class CorsAllowHeadersHeaderProvider implements HeaderProviderInterface
1017
{
11-
protected $headerName = 'Access-Control-Allow-Headers';
12-
13-
protected $headerValue = '';
18+
private $headerName;
1419

1520
/**
1621
* CORS configuration provider
@@ -19,9 +24,12 @@ class CorsAllowHeadersHeaderProvider implements HeaderProviderInterface
1924
*/
2025
private $corsConfiguration;
2126

22-
public function __construct(ConfigurationInterface $corsConfiguration)
23-
{
27+
public function __construct(
28+
ConfigurationInterface $corsConfiguration,
29+
string $headerName
30+
) {
2431
$this->corsConfiguration = $corsConfiguration;
32+
$this->headerName = $headerName;
2533
}
2634

2735
public function getName()
@@ -36,8 +44,6 @@ public function canApply() : bool
3644

3745
public function getValue()
3846
{
39-
return $this->corsConfiguration->getAllowedHeaders()
40-
? $this->corsConfiguration->getAllowedHeaders()
41-
: $this->headerValue;
47+
return $this->corsConfiguration->getAllowedHeaders();
4248
}
4349
}

‎app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowMethodsHeaderProvider.php

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,21 @@
11
<?php
2-
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
37

48
namespace Magento\GraphQl\Controller\HttpResponse\Cors;
59

6-
710
use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
811
use Magento\GraphQl\Model\Cors\ConfigurationInterface;
912

13+
/**
14+
* Provides value for Access-Control-Allow-Methods header if CORS is enabled
15+
*/
1016
class CorsAllowMethodsHeaderProvider implements HeaderProviderInterface
1117
{
12-
protected $headerName = 'Access-Control-Allow-Methods';
13-
14-
protected $headerValue = 'GET,POST,OPTIONS';
18+
private $headerName;
1519

1620
/**
1721
* CORS configuration provider
@@ -20,9 +24,12 @@ class CorsAllowMethodsHeaderProvider implements HeaderProviderInterface
2024
*/
2125
private $corsConfiguration;
2226

23-
public function __construct(ConfigurationInterface $corsConfiguration)
24-
{
27+
public function __construct(
28+
ConfigurationInterface $corsConfiguration,
29+
string $headerName
30+
) {
2531
$this->corsConfiguration = $corsConfiguration;
32+
$this->headerName = $headerName;
2633
}
2734

2835
public function getName()
@@ -37,8 +44,6 @@ public function canApply() : bool
3744

3845
public function getValue()
3946
{
40-
return $this->corsConfiguration->getAllowedMethods()
41-
? $this->corsConfiguration->getAllowedMethods()
42-
: $this->headerValue;
47+
return $this->corsConfiguration->getAllowedMethods();
4348
}
4449
}

‎app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowOriginHeaderProvider.php

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,21 @@
11
<?php
2-
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
37

48
namespace Magento\GraphQl\Controller\HttpResponse\Cors;
59

610
use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
711
use Magento\GraphQl\Model\Cors\ConfigurationInterface;
812

13+
/**
14+
* Provides value for Access-Control-Allow-Origin header if CORS is enabled
15+
*/
916
class CorsAllowOriginHeaderProvider implements HeaderProviderInterface
1017
{
11-
protected $headerName = 'Access-Control-Allow-Origin';
18+
private $headerName;
1219

1320
/**
1421
* CORS configuration provider
@@ -17,9 +24,12 @@ class CorsAllowOriginHeaderProvider implements HeaderProviderInterface
1724
*/
1825
private $corsConfiguration;
1926

20-
public function __construct(ConfigurationInterface $corsConfiguration)
21-
{
27+
public function __construct(
28+
ConfigurationInterface $corsConfiguration,
29+
string $headerName
30+
) {
2231
$this->corsConfiguration = $corsConfiguration;
32+
$this->headerName = $headerName;
2333
}
2434

2535
public function getName()

‎app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsMaxAgeHeaderProvider.php

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,21 @@
11
<?php
2-
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
37

48
namespace Magento\GraphQl\Controller\HttpResponse\Cors;
59

6-
710
use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
811
use Magento\GraphQl\Model\Cors\ConfigurationInterface;
912

13+
/**
14+
* Provides value for Access-Control-Max-Age header if CORS is enabled
15+
*/
1016
class CorsMaxAgeHeaderProvider implements HeaderProviderInterface
1117
{
12-
protected $headerName = 'Access-Control-Max-Age';
13-
14-
protected $headerValue = '86400';
18+
private $headerName;
1519

1620
/**
1721
* CORS configuration provider
@@ -20,9 +24,12 @@ class CorsMaxAgeHeaderProvider implements HeaderProviderInterface
2024
*/
2125
private $corsConfiguration;
2226

23-
public function __construct(ConfigurationInterface $corsConfiguration)
24-
{
27+
public function __construct(
28+
ConfigurationInterface $corsConfiguration,
29+
string $headerName
30+
) {
2531
$this->corsConfiguration = $corsConfiguration;
32+
$this->headerName = $headerName;
2633
}
2734

2835
public function getName()
@@ -37,8 +44,6 @@ public function canApply()
3744

3845
public function getValue()
3946
{
40-
return $this->corsConfiguration->getMaxAge()
41-
? $this->corsConfiguration->getMaxAge()
42-
: $this->headerValue;
47+
return $this->corsConfiguration->getMaxAge();
4348
}
4449
}

‎app/code/Magento/GraphQl/Model/Cors/Configuration.php

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,17 @@
11
<?php
2-
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
37

48
namespace Magento\GraphQl\Model\Cors;
59

6-
710
use Magento\Framework\App\Config\ScopeConfigInterface;
811

12+
/**
13+
* Configuration provider for GraphQL CORS settings
14+
*/
915
class Configuration implements ConfigurationInterface
1016
{
1117
const XML_PATH_CORS_HEADERS_ENABLED = 'graphql/cors/enabled';
@@ -47,7 +53,7 @@ public function getAllowedMethods(): ?string
4753

4854
public function getMaxAge(): int
4955
{
50-
return $this->scopeConfig->getValue(self::XML_PATH_CORS_MAX_AGE);
56+
return (int) $this->scopeConfig->getValue(self::XML_PATH_CORS_MAX_AGE);
5157
}
5258

5359
public function isCredentialsAllowed(): bool

‎app/code/Magento/GraphQl/Model/Cors/ConfigurationInterface.php

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,15 @@
11
<?php
2-
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
37

48
namespace Magento\GraphQl\Model\Cors;
59

6-
10+
/**
11+
* Interface for configuration provider for GraphQL CORS settings
12+
*/
713
interface ConfigurationInterface
814
{
915
public function isEnabled() : bool;

‎app/code/Magento/GraphQl/etc/adminhtml/system.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,27 +20,32 @@
2020

2121
<field id="allowed_origins" translate="label" type="text" sortOrder="10" showInDefault="1" canRestore="1">
2222
<label>Allowed origins</label>
23+
<comment>The Access-Control-Allow-Origin response header indicates whether the response can be shared with requesting code from the given origin. Fill this field with one or more origins (comma separated) or use '*' to allow access from all origins.</comment>
2324
<depends>
2425
<field id="graphql/cors/enabled">1</field>
2526
</depends>
2627
</field>
2728

2829
<field id="allowed_methods" translate="label" type="text" sortOrder="20" showInDefault="1" canRestore="1">
2930
<label>Allowed methods</label>
31+
<comment>The Access-Control-Allow-Methods response header specifies the method or methods allowed when accessing the resource in response to a preflight request. Use comma separated methods (e.g. GET,POST)</comment>
3032
<depends>
3133
<field id="graphql/cors/enabled">1</field>
3234
</depends>
3335
</field>
3436

3537
<field id="allowed_headers" translate="label" type="text" sortOrder="30" showInDefault="1" canRestore="1">
3638
<label>Allowed headers</label>
39+
<comment>The Access-Control-Allow-Headers response header is used in response to a preflight request which includes the Access-Control-Request-Headers to indicate which HTTP headers can be used during the actual request. Use comma separated headers.</comment>
3740
<depends>
3841
<field id="graphql/cors/enabled">1</field>
3942
</depends>
4043
</field>
4144

4245
<field id="max_age" translate="label" type="text" sortOrder="40" showInDefault="1" canRestore="1">
4346
<label>Max Age</label>
47+
<validate>validate-digits</validate>
48+
<comment>The Access-Control-Max-Age response header indicates how long the results of a preflight request (that is the information contained in the Access-Control-Allow-Methods and Access-Control-Allow-Headers headers) can be cached.</comment>
4449
<depends>
4550
<field id="graphql/cors/enabled">1</field>
4651
</depends>
@@ -49,6 +54,7 @@
4954
<field id="allow_credentials" translate="label" type="select" sortOrder="50" showInDefault="1" canRestore="1">
5055
<label>Credentials Allowed</label>
5156
<source_model>Magento\Config\Model\Config\Source\Yesno</source_model>
57+
<comment>The Access-Control-Allow-Credentials response header tells browsers whether to expose the response to frontend code when the request's credentials mode is include.</comment>
5258
<depends>
5359
<field id="graphql/cors/enabled">1</field>
5460
</depends>

‎app/code/Magento/GraphQl/etc/di.xml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,4 +100,29 @@
100100
</type>
101101

102102
<preference for="Magento\GraphQl\Model\Cors\ConfigurationInterface" type="Magento\GraphQl\Model\Cors\Configuration" />
103+
<type name="\Magento\GraphQl\Controller\HttpResponse\Cors\CorsMaxAgeHeaderProvider">
104+
<arguments>
105+
<argument name="headerName" xsi:type="string">Access-Control-Max-Age</argument>
106+
</arguments>
107+
</type>
108+
<type name="\Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowCredentialsHeaderProvider">
109+
<arguments>
110+
<argument name="headerName" xsi:type="string">Access-Control-Allow-Credentials</argument>
111+
</arguments>
112+
</type>
113+
<type name="\Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowHeadersHeaderProvider">
114+
<arguments>
115+
<argument name="headerName" xsi:type="string">Access-Control-Allow-Headers</argument>
116+
</arguments>
117+
</type>
118+
<type name="\Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowMethodsHeaderProvider">
119+
<arguments>
120+
<argument name="headerName" xsi:type="string">Access-Control-Allow-Methods</argument>
121+
</arguments>
122+
</type>
123+
<type name="\Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowOriginHeaderProvider">
124+
<arguments>
125+
<argument name="headerName" xsi:type="string">Access-Control-Allow-Origin</argument>
126+
</arguments>
127+
</type>
103128
</config>

0 commit comments

Comments
 (0)