init

src/Middleware/CorsMiddleware.php

@@ -0,0 +1,48 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Middleware;
+
+use Cake\Http\Response;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+use Psr\Http\Server\MiddlewareInterface;
+use Psr\Http\Server\RequestHandlerInterface;
+
+/**
+ * Adds permissive CORS headers to /api responses and answers preflight requests.
+ */
+class CorsMiddleware implements MiddlewareInterface
+{
+    /**
+     * @param \Psr\Http\Message\ServerRequestInterface $request The request.
+     * @param \Psr\Http\Server\RequestHandlerInterface $handler The request handler.
+     * @return \Psr\Http\Message\ResponseInterface
+     */
+    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
+    {
+        if (!str_starts_with($request->getUri()->getPath(), '/api')) {
+            return $handler->handle($request);
+        }
+
+        if ($request->getMethod() === 'OPTIONS') {
+            return $this->addHeaders(new Response(['status' => 204]));
+        }
+
+        return $this->addHeaders($handler->handle($request));
+    }
+
+    /**
+     * @param \Psr\Http\Message\ResponseInterface $response Response
+     * @return \Psr\Http\Message\ResponseInterface
+     */
+    protected function addHeaders(ResponseInterface $response): ResponseInterface
+    {
+        return $response
+            ->withHeader('Access-Control-Allow-Origin', '*')
+            ->withHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS')
+            ->withHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type, Accept')
+            ->withHeader('Access-Control-Expose-Headers', 'X-Total-Count')
+            ->withHeader('Access-Control-Max-Age', '86400');
+    }
+}