feat: add CORS filter #8649

kenjis · 2024-03-22T08:41:11Z

Description

add Cors filter class
add HTTP\Cors class

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

kenjis · 2024-03-24T12:47:05Z

Now the CORS filter always adds Vary: Origin header.
But when the following three requests come:

(1) Plain OPTIONS request (CORS filter does not handle)

OPTIONS /

(2) Invalid preflight request (CORS filter does not handle)

OPTIONS /
Origin: https://app.example.com/

(3) Normal preflight request (CORS filter does handle)

OPTIONS /
Origin: https://app.example.com/
Access-Control-Request-Method: PUT

(1) and (2) are cached (if there is an intermediate cache to cache them) and the cached (2) will be returned to the request (3). So the current implementation is not good.

(Added)
This was fixed. Now it always adds Vary: Access-Control-Request-Method header.

…eablility instead of `Vary: Origin`. See codeigniter4#8649 (comment)

michalsn

Nice feature - well documented.

datamweb · 2024-03-27T09:20:24Z

app/Config/Cors.php

+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
+         */
+        'maxAge' => 7200,


What is your criteria for choosing this number by default? Laravel assumes 0.

It is the same as session expiration.
I think the CORS config is not often changed, so it may be better to be longer.

tests/system/Filters/CorsTest.php

datamweb · 2024-03-27T09:28:34Z

user_guide_src/source/libraries/cors/002.php

+    // ...
+    public array $filters = [
+        // ...
+        'cors' => [


Is there a way to use a different configuration (exactly like ['filter' => 'cors:api'] )? If yes, please document.

It is documented in the Filters page.
https://codeigniter4.github.io/CodeIgniter4/incoming/filters.html#filter-arguments

Added a link. 3a7e880

Also, this is easier to read.

It was difficult to read when running phpunit --testdox

See rs/cors#10

For better readablitiy.

…eablility instead of `Vary: Origin`. See codeigniter4#8649 (comment)

datamweb

LGTM! Thanks.

@yasinpalizban, This PR may be interesting for you.

krangadurai · 2024-06-17T11:53:36Z

hi , im reccently try cors thing , ,i cann't connect cors way i don't know why its happening,

krangadurai · 2024-06-17T11:54:45Z

Access-Control-Allow-Headers not working

kenjis marked this pull request as draft March 22, 2024 08:41

kenjis added 4.5 enhancement PRs that improve existing functionalities labels Mar 22, 2024

kenjis force-pushed the feat-cors branch 6 times, most recently from 2a3cb63 to 4dfb2d0 Compare March 23, 2024 00:51

kenjis changed the title ~~feat: add Cors filter~~ feat: add CORS filter Mar 23, 2024

kenjis force-pushed the feat-cors branch 4 times, most recently from 3712869 to 86ee415 Compare March 24, 2024 05:12

kenjis marked this pull request as ready for review March 24, 2024 09:40

kenjis marked this pull request as draft March 24, 2024 12:50

kenjis added a commit to kenjis/CodeIgniter4 that referenced this pull request Mar 25, 2024

fix: always add Vary: Access-Control-Request-Method header for cach…

3f06262

…eablility instead of `Vary: Origin`. See codeigniter4#8649 (comment)

kenjis added a commit to kenjis/CodeIgniter4 that referenced this pull request Mar 25, 2024

fix: always add Vary: Access-Control-Request-Method header for cach…

4beb7ec

…eablility instead of `Vary: Origin`. See codeigniter4#8649 (comment)

kenjis force-pushed the feat-cors branch from 3f06262 to 4beb7ec Compare March 25, 2024 01:01

kenjis marked this pull request as ready for review March 25, 2024 01:05

michalsn approved these changes Mar 25, 2024

View reviewed changes

datamweb reviewed Mar 27, 2024

View reviewed changes

kenjis added 7 commits March 27, 2024 19:20

feat: add HTTP\Cors class

fd25f15

feat: add Cors filter

31de58e

docs: fix HTTP method name in comment

78fd0b4

feat: make $allowedOriginsPatterns more secure

d42c786

Also, this is easier to read.

chore: add exclude

48ac9cd

test: fix return type

fafd863

refactor: extract checkWildcard() method

ab31388

kenjis added 18 commits March 27, 2024 19:20

refactor: extract checkWildcardAndCredentials() method

026eeb0

test: fix typo in method name

f879d28

test: add tests for exception messages

6751eef

test: add credit in comment

2f01450

docs: add user guide

a019896

test: rename test method

ee1eb5c

It was difficult to read when running phpunit --testdox

feat: support multiple configurations

681c41e

test: move private methods up

85dda5d

feat: always add 'Vary: Origin' header to OPTIONS requests

8f0be94

See rs/cors#10

docs: add @var

ba09b87

refactor: early return

0da9ae7

docs: changed options routes

0faef2d

docs: add about supportsCredentials

c93083e

docs: remove duplicated sample code

161e889

For better readablitiy.

docs: improve descriptions

9950328

fix: always add Vary: Access-Control-Request-Method header for cach…

029db62

…eablility instead of `Vary: Origin`. See codeigniter4#8649 (comment)

docs: add doc comments

2664c06

test: add return types

d52f07b

kenjis force-pushed the feat-cors branch from daa443a to d52f07b Compare March 27, 2024 10:20

kenjis added 2 commits March 27, 2024 19:28

test: add types

84855d6

docs: add link to Filter argument

3a7e880

datamweb approved these changes Mar 27, 2024

View reviewed changes

kenjis merged commit 62bcfa8 into codeigniter4:4.5 Mar 30, 2024
41 checks passed

kenjis deleted the feat-cors branch March 30, 2024 23:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add CORS filter #8649

feat: add CORS filter #8649

kenjis commented Mar 22, 2024 •

edited

Loading

kenjis commented Mar 24, 2024 •

edited

Loading

michalsn left a comment

datamweb Mar 27, 2024

kenjis Mar 27, 2024

datamweb Mar 27, 2024

kenjis Mar 27, 2024

kenjis Mar 27, 2024

datamweb left a comment

krangadurai commented Jun 17, 2024 •

edited

Loading

krangadurai commented Jun 17, 2024 •

edited

Loading

feat: add CORS filter #8649

feat: add CORS filter #8649

Conversation

kenjis commented Mar 22, 2024 • edited Loading

kenjis commented Mar 24, 2024 • edited Loading

michalsn left a comment

Choose a reason for hiding this comment

datamweb Mar 27, 2024

Choose a reason for hiding this comment

kenjis Mar 27, 2024

Choose a reason for hiding this comment

datamweb Mar 27, 2024

Choose a reason for hiding this comment

kenjis Mar 27, 2024

Choose a reason for hiding this comment

kenjis Mar 27, 2024

Choose a reason for hiding this comment

datamweb left a comment

Choose a reason for hiding this comment

krangadurai commented Jun 17, 2024 • edited Loading

krangadurai commented Jun 17, 2024 • edited Loading

kenjis commented Mar 22, 2024 •

edited

Loading

kenjis commented Mar 24, 2024 •

edited

Loading

krangadurai commented Jun 17, 2024 •

edited

Loading

krangadurai commented Jun 17, 2024 •

edited

Loading