Viewing file:  HandleCors.php (3.41 KB) -rw-r--r--
Select action/file-type:
 (+) |  (+) |  (+) | Code (+) | Session (+) |  (+) | SDB (+) |  (+) |  (+) |  (+) |  (+) |  (+) |
<?php
namespace Fruitcake\Cors;
use Closure;
use Asm89\Stack\CorsService;
use Illuminate\Http\Request;
use Illuminate\Contracts\Container\Container;
use Illuminate\Foundation\Http\Events\RequestHandled;
use Symfony\Component\HttpFoundation\Response;
class HandleCors
{
/** @var CorsService $cors */
protected $cors;
/** @var \Illuminate\Contracts\Container\Container $container */
protected $container;
public function __construct(CorsService $cors, Container $container)
{
$this->cors = $cors;
$this->container = $container;
}
/**
* Handle an incoming request. Based on Asm89\Stack\Cors by asm89
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @return Response
*/
public function handle($request, Closure $next)
{
// Check if we're dealing with CORS and if we should handle it
if (! $this->shouldRun($request)) {
return $next($request);
}
// For Preflight, return the Preflight response
if ($this->cors->isPreflightRequest($request)) {
return $this->cors->handlePreflightRequest($request);
}
// If the request is not allowed, return 403
if (! $this->cors->isActualRequestAllowed($request)) {
return new Response('Not allowed in CORS policy.', 403);
}
// Add the headers on the Request Handled event as fallback in case of exceptions
if (class_exists(RequestHandled::class) && $this->container->bound('events')) {
$this->container->make('events')->listen(RequestHandled::class, function (RequestHandled $event) {
$this->addHeaders($event->request, $event->response);
});
}
// Handle the request
$response = $next($request);
// Add the CORS headers to the Response
return $this->addHeaders($request, $response);
}
/**
* Determine if the request has a URI that should pass through the CORS flow.
*
* @param \Illuminate\Http\Request $request
* @return bool
*/
protected function shouldRun(Request $request): bool
{
// Check if this is an actual CORS request
if (! $this->cors->isCorsRequest($request)) {
return false;
}
return $this->isMatchingPath($request);
}
/**
* The the path from the config, to see if the CORS Service should run
*
* @param \Illuminate\Http\Request $request
* @return bool
*/
protected function isMatchingPath(Request $request): bool
{
// Get the paths from the config or the middleware
$paths = $this->container['config']->get('cors.paths', []);
foreach ($paths as $path) {
if ($path !== '/') {
$path = trim($path, '/');
}
if ($request->fullUrlIs($path) || $request->is($path)) {
return true;
}
}
return false;
}
/**
* Add the headers to the Response, if they don't exist yet.
*
* @param Request $request
* @param Response $response
* @return Response
*/
protected function addHeaders(Request $request, Response $response): Response
{
if (! $response->headers->has('Access-Control-Allow-Origin')) {
$response = $this->cors->addActualRequestHeaders($response, $request);
}
return $response;
}
}
|