cross/laravel-cors

Adds CORS (Cross-Origin Resource Sharing) headers support in your Laravel application

dev-master / 0.11.x-dev 2018-08-07 09:49 UTC

Requires

• php: >=5.5.9
• illuminate/support: 5.3.x|5.4.x|5.5.x|5.6.x
• symfony/http-foundation: ^3.1|^4
• symfony/http-kernel: ^3.1|^4

Requires (Dev)

• orchestra/testbench: 3.x
• phpunit/phpunit: ^4.8|^5.2
• squizlabs/php_codesniffer: ^2.3

MIT

• wendy

• api
• cors
• crossdomain
• laravel

README

composer.json

  "repositories": {
       ...
       
       "cross" : {
           "type": "composer",
           "url": "https://packagist.org"
       },
       
       ...
   }

Require the cross/laravel-cors package in your composer.json and update your dependencies:

$ composer require cross/laravel-cors dev-master

config/app.php

'providers' => [
    ...
    Cross\Cors\ServiceProvider::class,
    ...
],

'aliases' => [
    ...
    'cors' => Cross\Cors\FacadeCors::class,
    ...
]

App/Http/Kernel.php

$app->routeMiddleware([
    // ...
    'cors' => \Cross\Cors\HandleCors::class,
]);

Configuration

The defaults are set in config/cors.php. Copy this file to your own config directory to modify the values. You can publish the config using this command:

$ php artisan vendor:publish --provider="Cross\Cors\ServiceProvider"

Note: When using custom headers, like X-Auth-Token or X-Requested-With, you must set the allowedHeaders to include those headers. You can also set it to array('*') to allow all custom headers.

Note: If you are explicitly whitelisting headers, you must include Origin or requests will fail to be recognized as CORS.

return [
     /*
     |--------------------------------------------------------------------------
     | Laravel CORS
     |--------------------------------------------------------------------------
     |
     | allowedOrigins, allowedHeaders and allowedMethods can be set to array('*')
     | to accept any value.
     |
     */
    'supportsCredentials' => false,
    'allowedOrigins' => ['*'],
    'allowedHeaders' => ['Content-Type', 'X-Requested-With'],
    'allowedMethods' => ['*'], // ex: ['GET', 'POST', 'PUT',  'DELETE']
    'exposedHeaders' => [],
    'maxAge' => 0,
]

allowedOrigins, allowedHeaders and allowedMethods can be set to array('*') to accept any value.

License

Released under the MIT License, see LICENSE.