Download the PHP package agungsugiarto/codeigniter4-cors without Composer
On this page you can find all versions of the php package agungsugiarto/codeigniter4-cors. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download agungsugiarto/codeigniter4-cors
More information about agungsugiarto/codeigniter4-cors
Files in agungsugiarto/codeigniter4-cors
Package codeigniter4-cors
Short Description Send CORS Headers in a CodeIgniter 4 application.
License MIT
Informations about the package codeigniter4-cors
CORS Filter for CodeIgniter 4
Inspired from https://github.com/asm89/stack-cors for CodeIgniter 4
About
The codeigniter4-cors
package allows you to send Cross-Origin Resource Sharing
headers with Codeigniter4 filter configuration.
Features
- Handles CORS pre-flight OPTIONS requests
- Adds CORS headers to your responses
- Match routes to only add CORS to certain Requests
Upgrade from 2.x to v3.x
Upgrade from version 2.x to 3.x. Open your composer.json
find agungsugiarto/codeigniter4-cors
and change value to ^3.0
Installation
Require the agungsugiarto/codeigniter4-cors
package in your composer.json
and update your dependencies:
Global usage
To allow CORS for all your routes, first register CorsFilter.php
filter at the top of the $aliases
property of App/Config/Filter.php
class:
Global restrictions
Restrict routes based on their URI pattern by editing app/Config/Filters.php and adding them to the
$filters
array, e.g.:
Restricting a single route
Any single route can be restricted by adding the filter option to the last parameter in any of the route definition methods:
Restricting Route Groups
In the same way, entire groups of routes can be restricted within the group()
method:
Configuration
The defaults are set in config/cors.php
. Publish the config to copy the file to your own config:
Note: When using custom headers, like
X-Auth-Token
orX-Requested-With
, you must set theallowedHeaders
to include those headers. You can also set it to['*']
to allow all custom headers.Note: If you are explicitly whitelisting headers, you must include
Origin
or requests will fail to be recognized as CORS.
Options
Option | Description | Default value |
---|---|---|
allowedOrigins | Matches the request origin. Wildcards can be used, eg. *.mydomain.com |
['*'] |
allowedOriginsPatterns | Matches the request origin with preg_match. | [] |
allowedMethods | Matches the request method. | ['*'] |
allowedHeaders | Sets the Access-Control-Allow-Headers response header. | ['*'] |
exposedHeaders | Sets the Access-Control-Expose-Headers response header. | false |
maxAge | Sets the Access-Control-Max-Age response header. | 0 |
supportsCredentials | Sets the Access-Control-Allow-Credentials header. | false |
allowedOrigins
, allowedHeaders
and allowedMethods
can be set to ['*']
to accept any value.
Note: For
allowedOrigins
you must include the scheme when not using a wildcard, eg.['http://example.com', 'https://example.com']
. You must also take into account that the scheme will be present when using allowed_origins_patterns.Note: Try to be a specific as possible. You can start developing with loose constraints, but it's better to be as strict as possible!
License
Released under the MIT License, see LICENSE.