�PNG  IHDR��;���IDATx��ܻn�0���K�� �)(�pA��� ���7�LeG{�� �§㻢|��ذaÆ 6lذaÆ 6lذaÆ 6lom��$^�y���ذag�5bÆ 6lذaÆ 6lذa{���� 6lذaÆ �`����}H�Fkm�,�m����Ӫ���ô�ô!� �x�|'ܢ˟;�E:���9�&ᶒ�}�{�v]�n&�6� �h��_��t�ڠ͵-ҫ���Z;��Z$�.�P���k�ž)�!��o���>}l�eQfJ�T��u і���چ��\��X=8��Rن4`Vw�l�>����n�G�^��i�s��"ms�$�u��i��?w�bs[m�6�K4���O���.�4��%����/����b�C%��t ��M�ז� �-l�G6�mrz2���s�%�9��s@���-�k�9�=���)������k�B5����\��+͂�Zsٲ ��Rn��~G���R���C����� �wIcI��n7jJ���hۛNCS|���j0��8y�iHKֶۛ�k�Ɉ+;Sz������L/��F�*\��Ԕ�#"5��m�2��[S��������=�g��n�a�P�e�ғ�L�� lذaÆ 6l�^k��̱aÆ 6lذaÆ 6lذa;���� �_��ذaÆ 6lذaÆ 6lذaÆ ���R���IEND�B` # Stack/Cors Library and middleware enabling cross-origin resource sharing for your http-{foundation,kernel} using application. It attempts to implement the [W3C Recommendation] for cross-origin resource sharing. [W3C Recommendation]: http://www.w3.org/TR/cors/ Build status: ![.github/workflows/run-tests.yml](https://github.com/asm89/stack-cors/workflows/.github/workflows/run-tests.yml/badge.svg) ## Installation Require `asm89/stack-cors` using composer. ## Usage This package can be used as a library or as [stack middleware]. [stack middleware]: http://stackphp.com/ ### Options | Option | Description | Default value | |------------------------|------------------------------------------------------------|---------------| | allowedMethods | Matches the request method. | `array()` | | allowedOrigins | Matches the request origin. | `array()` | | allowedOriginsPatterns | Matches the request origin with `preg_match`. | `array()` | | allowedHeaders | Sets the Access-Control-Allow-Headers response header. | `array()` | | exposedHeaders | Sets the Access-Control-Expose-Headers response header. | `false` | | maxAge | Sets the Access-Control-Max-Age response header. | `false` | | supportsCredentials | Sets the Access-Control-Allow-Credentials header. | `false` | The _allowedMethods_ and _allowedHeaders_ options are case-insensitive. You don't need to provide both _allowedOrigins_ and _allowedOriginsPatterns_. If one of the strings passed matches, it is considered a valid origin. If `array('*')` is provided to _allowedMethods_, _allowedOrigins_ or _allowedHeaders_ all methods / origins / headers are allowed. ### Example: using the library ```php array('x-allowed-header', 'x-other-allowed-header'), 'allowedMethods' => array('DELETE', 'GET', 'POST', 'PUT'), 'allowedOrigins' => array('http://localhost'), 'allowedOriginsPatterns' => array('/localhost:\d/'), 'exposedHeaders' => false, 'maxAge' => false, 'supportsCredentials' => false, )); $cors->addActualRequestHeaders(Response $response, $origin); $cors->handlePreflightRequest(Request $request); $cors->isActualRequestAllowed(Request $request); $cors->isCorsRequest(Request $request); $cors->isPreflightRequest(Request $request); ``` ## Example: using the stack middleware ```php array('x-allowed-header', 'x-other-allowed-header'), // you can use array('*') to allow any methods 'allowedMethods' => array('DELETE', 'GET', 'POST', 'PUT'), // you can use array('*') to allow requests from any origin 'allowedOrigins' => array('localhost'), // you can enter regexes that are matched to the origin request header 'allowedOriginsPatterns' => array('/localhost:\d/'), 'exposedHeaders' => false, 'maxAge' => false, 'supportsCredentials' => false, )); ```