Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,24 @@ All notable changes to this project will be documented in this file, in reverse

- Nothing.

## 1.0.1 - 2020-09-02

-----

### Release Notes for [1.0.1](https://github.com/mezzio/mezzio-cors/milestone/2)

1.0.x bugfix release (patch)

### 1.0.1

- Total issues resolved: **0**
- Total pull requests resolved: **1**
- Total contributors: **1**

#### Documentation,Enhancement

- [6: Updates documentation](https://github.com/mezzio/mezzio-cors/pull/6) thanks to @froschdesign

## 1.0.0 - 2020-09-02

### Added
Expand Down
2 changes: 1 addition & 1 deletion composer.json
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "mezzio/mezzio-cors",
"type": "library",
"description": "CORS subcomponent for Mezzio",
"description": "CORS component for Mezzio and other PSR-15 middleware runners.",
"keywords": [
"cors",
"mezzio",
Expand Down
5 changes: 5 additions & 0 deletions docs/book/v1/installation.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
**This is only a placeholder.**

The content of this page can be found under:

https://github.com/laminas/documentation-theme/blob/master/theme/pages/installation.html
47 changes: 28 additions & 19 deletions docs/book/v1/intro.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,15 @@
# mezzio-cors
# Introduction

CORS subcomponent for [Mezzio](https://github.com/mezzio/mezzio).
This component creates CORS details for your application. If the
`CorsMiddleware` detects a `CORS preflight`, the middleware will start do detect
the proper `CORS` configuration. The `Router` is being used to detect every
allowed request method by executing a route match with all possible request
methods. Therefore, for every preflight request, there is at least one `Router`
request (depending on the configuration of the route, it might be just one or we
are executing a check for **every** request method).

This extension creates CORS details for your application. If the `CorsMiddleware` detects a `CORS preflight`, the middleware will start do detect the proper `CORS` configuration.
The `Router` is being used to detect every allowed request method by executing a route match with all possible request methods. Therefore, for every preflight request, there is at least one `Router` request (depending on the configuration of the route, it might be just one or we are executing a check for **every** request method).

Here is a list of the request methods being checked for the `CORS preflight` information:
Here is a list of the request methods being checked for the `CORS preflight`
information:

- DELETE
- GET
Expand All @@ -16,22 +20,27 @@ Here is a list of the request methods being checked for the `CORS preflight` inf
- PUT
- TRACE

The order of the headers might vary, depending on what request method is being requested with the `CORS preflight` request.
In the end, the response contains **every** possible request method of the route due to what the router tells the `ConfigurationLocator`.


The allowed origins can be configured as strings which can be matched with [`fnmatch`](https://www.php.net/manual/en/function.fnmatch.php). Therefore, wildcards are possible.

## Installation
The order of the headers might vary, depending on what request method is being
requested with the `CORS preflight` request. In the end, the response contains
**every** possible request method of the route due to what the router tells the
`ConfigurationLocator`.

```bash
$ composer require mezzio/mezzio-cors
```
The allowed origins can be configured as strings which can be matched with
[`fnmatch`](https://www.php.net/manual/en/function.fnmatch.php). Therefore,
wildcards are possible.

## Features

mezzio-cors provides a [`CorsMiddleware`](middleware.md) which works out of the box with once created a global configuration file. It can safely be added to the projects pipeline as CORS details are needed for *every* request (in case its a CORS request).
mezzio-cors provides a [`CorsMiddleware`](middleware.md) which works out of the
box with once created a global configuration file. It can safely be added to the
projects pipeline as CORS details are needed for *every* request (in case its a
CORS request).

It uses the [mezzio-router](https://github.com/mezzio/mezzio-router) to match the incoming URI. It starts with the HTTP request method which is provided by the Request via the `Access-Control-Request-Method` header and checks *all* request methods until it matches a route. If that route states to be explicit, the response is created immediately.
It uses the [mezzio-router](https://github.com/mezzio/mezzio-router) to match
the incoming URI. It starts with the HTTP request method which is provided by
the Request via the `Access-Control-Request-Method` header and checks *all*
request methods until it matches a route. If that route states to be explicit,
the response is created immediately.

If the route is not explicit, *all* request methods are checked to provide a list of possible request methods to the client.
If the route is not explicit, *all* request methods are checked to provide a
list of possible request methods to the client.
52 changes: 33 additions & 19 deletions docs/book/v1/middleware.md
Original file line number Diff line number Diff line change
@@ -1,13 +1,17 @@
# CORS Middleware
# Middleware

mezzio-cors provides middleware consuming
[PSR-7](http://www.php-fig.org/psr/psr-7/) HTTP message instances, via implementation of [PSR-15](https://www.php-fig.org/psr/psr-15/) interfaces.
[PSR-7](http://www.php-fig.org/psr/psr-7/) HTTP message instances, via
implementation of [PSR-15](https://www.php-fig.org/psr/psr-15/) interfaces.

This middleware checks, if the incoming request is a CORS request. If so, it makes a distinction between a so called [Preflight request](#preflight-request) or the [regular request](#cors-request).
This middleware checks, if the incoming request is a CORS request. If so, it
makes a distinction between a so called [Preflight request](#preflight-request)
or the [regular request](#cors-request).

## Preflight request
## Preflight Request

A Preflight request should be a light call which provides the Browser with the CORS informations it needs to execute the regular (CORS) request.
A Preflight request should be a light call which provides the Browser with the
CORS informations it needs to execute the regular (CORS) request.

These informations are:
- Domain accepted for executing CORS request?
Expand All @@ -16,13 +20,16 @@ These informations are:
- Which Headers are provided in the response?
- Which HTTP Methods are accepted by that Endpoint?

## CORS request
## CORS Request

The CORS request is the actual request. That request SHOULD to be already verified. If its not verified by a previous [Preflight request](#preflight-request), the request will be aborted with a `403 Forbidden` response.
The CORS request is the actual request. That request SHOULD to be already
verified. If its not verified by a previous [Preflight request](#preflight-request),
the request will be aborted with a `403 Forbidden` response.

## Configuration

There are 2 ways of configuring CORS in your project. Either create a global configuration file like `cors.global.php` or add a route specific configuration.
There are 2 ways of configuring CORS in your project. Either create a global
configuration file like `cors.global.php` or add a route specific configuration.

On the project level, you can only configure the following Headers:

Expand All @@ -34,7 +41,9 @@ On the project level, you can only configure the following Headers:
| `credentials_allowed` | bool | Access-Control-Allow-Credentials
| `exposed_headers` | string[] | Access-Control-Exposed-Headers

On the route level, you can configure all of the projects configuration settings and if the configuration of the route should either override the project configuration (default) or merge it.
On the route level, you can configure all of the projects configuration settings
and if the configuration of the route should either override the project
configuration (default) or merge it.


| Configuration | Type | Header
Expand All @@ -47,13 +56,16 @@ On the route level, you can configure all of the projects configuration settings
| `credentials_allowed` | bool | Access-Control-Allow-Credentials
| `exposed_headers` | string[] | Access-Control-Exposed-Headers

The parameter `overrides_project_configuration` handles the way how the configuration is being merged. The default setting is `true` to ensure that a route configuration has to specify every information it will provide.
The parameter `overrides_project_configuration` handles the way how the
configuration is being merged. The default setting is `true` to ensure that a
route configuration has to specify every information it will provide.

The parameter `explicit` tells the `ConfigurationLocator` to stop trying other request methods to match the same route because there wont be any other method.
The parameter `explicit` tells the `ConfigurationLocator` to stop trying other
request methods to match the same route because there wont be any other method.

### Examples for project configurations
### Examples for Project Configurations

#### Allow every origin
#### Allow Every Origin

```php
<?php
Expand All @@ -73,7 +85,7 @@ return [
];
```

#### Allow every origin from a specific domain and its subdomains
#### Allow Every Origin from a Specific Domain and Its Subdomains

```php
<?php
Expand All @@ -94,9 +106,9 @@ return [
];
```

### Examples for route configurations
### Examples for Route Configurations

#### Make the configuration explicit to avoid multiple router match requests
#### Make the Configuration Explicit to Avoid Multiple Router Match Requests

```php
<?php
Expand Down Expand Up @@ -145,7 +157,8 @@ return [
];
```

Result of this configuration for the `CORS preflight` of `/foo` for the upcoming `GET` request will look like this:
Result of this configuration for the `CORS preflight` of `/foo` for the upcoming
`GET` request will look like this:

| Configuration | Parameter |
|:------------- |:-------------:|
Expand All @@ -158,7 +171,7 @@ Result of this configuration for the `CORS preflight` of `/foo` for the upcoming

**Did you note the missing `DELETE`? This is because of the `explicit` flag! Also note the empty `exposed_headers` which is due to the project overriding (`overrides_project_configuration`) parameter.**

#### Enable project merging
#### Enable Project Merging

```php
<?php
Expand Down Expand Up @@ -206,7 +219,8 @@ return [
];
```

Result of this configuration for the `CORS preflight` of `/foo` for the upcoming `GET` request will look like this:
Result of this configuration for the `CORS preflight` of `/foo` for the upcoming
`GET` request will look like this:

| Configuration | Parameter |
|:-------------|:-------------:|
Expand Down
5 changes: 4 additions & 1 deletion mkdocs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,12 @@ site_dir: docs/html
nav:
- Home: index.md
- Introduction: v1/intro.md
- Installation: v1/installation.md
- Middleware: v1/middleware.md
site_name: mezzio-cors
site_description: 'CORS subcomponent for Mezzio'
site_description: 'CORS component for Mezzio and other PSR-15 middleware runners.'
repo_url: 'https://github.com/mezzio/mezzio-cors'
extra:
project: Mezzio
installation:
config_provider_class: 'Mezzio\Cors\ConfigProvider'