README

This package provides a simple CORS controller for Flow applications.

The headers are only applied if the controller extends the AbstractCorsController class.

Configuration

Enable CORS support

VentusForge:
  Cors:
    enabled: true

Add different headers for a path

VentusForge:
  Cors:
    headers:
      /api/v1/some-api/create:
        'Access-Control-Allow-Methods':
          - 'PUT'
          - 'OPTIONS'

If a header is not defined, the default value from VentusForge.Cors.headers.defaults is used.

To remove a header, set it to null.

Override the origins

VentusForge:
  Cors:
    enabled: false
    headers:
      defaults:
        'Access-Control-Allow-Origin':
          - .foo-bar.com
          - .bar-baz.com'

Use the Abstract CORS Controller

<?php

declare(strict_types=1);

namespace Foo\Bar\Controller;

use Neos\Flow\Annotations as Flow;

class SomeController extends \VentusForge\Cors\Controller\AbstractCorsController
{
    /**
     * @inheritDoc
     */
    protected function initializeAction(): void
    {
        // if you override the initializeAction() method, make sure to call the parent method
        parent::initializeAction();
    }
}

Planned features

Replace the controller with a middleware

ventusforge / flow-cors

Maintainers

Details