shlinkio/shlink
1
0
Fork 0
mirror of https://github.com/shlinkio/shlink.git synced 2025-12-10 22:13:47 -06:00
Code Issues Packages Projects Releases 146 Wiki Activity

Allow credentials to be enabled in CORS

Browse Source
This commit is contained in:
Alejandro Celaya 2025-07-08 10:36:12 +02:00
parent 92d7a44cee
commit 834bc4ae20
2 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
module/Core/src/Config/Options/CorsOptions.php
View File

@ -8,6 +8,7 @@ use Shlinkio\Shlink\Core\Config\EnvVars;
use function Shlinkio\Shlink\Core\ArrayUtils\contains;
use function Shlinkio\Shlink\Core\splitByComma;
use function strtolower;
final readonly class CorsOptions
{
@ -21,9 +22,10 @@ final readonly class CorsOptions
public bool $allowCredentials = false,
public int $maxAge = 3600,
) {
$this->allowOrigins = $allowOrigins !== '*' && $allowOrigins !== self::ORIGIN_PATTERN
? splitByComma($allowOrigins)
: $allowOrigins;
$lowerCaseAllowOrigins = strtolower($allowOrigins);
$this->allowOrigins = contains($lowerCaseAllowOrigins, ['*', self::ORIGIN_PATTERN])
? $lowerCaseAllowOrigins
: splitByComma($lowerCaseAllowOrigins);
}
public static function fromEnv(): self

4
module/Rest/src/Middleware/CrossDomainMiddleware.php
View File

@ -44,6 +44,10 @@ readonly class CrossDomainMiddleware implements MiddlewareInterface, RequestMeth
'Access-Control-Max-Age' => $this->options->maxAge,
];
if ($this->options->allowCredentials) {
$corsHeaders['Access-Control-Allow-Credentials'] = 'true';
}
// Options requests should always be empty and have a 204 status code
return EmptyResponse::withHeaders([...$response->getHeaders(), ...$corsHeaders]);
}