copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Enhance CORS handling with dynamic origin validation and credentials support in Nginx. Update Traefik to include additional allowed origins.

Browse Source
This commit is contained in:
Jeppe Bundgaard
2026-03-18 14:15:28 +01:00
parent 6b928cfce7
commit 60f6cbee84
3 changed files with 35 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/index.php
+19 -10
View File
@@ -8,21 +8,30 @@ ini_set('zlib.output_compression', false);
*/
const WD = __DIR__;
require_once 'config.php';
/** CORS */
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Customer-Number");
header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
$allowed_origins = array_map('trim', explode(',', (string)($CORS ?? '*')));
if ($CORS === '*' || ($origin && in_array($origin, $allowed_origins))) {
header("Access-Control-Allow-Origin: " . ($origin ?: '*'));
header("Access-Control-Allow-Credentials: true");
header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Customer-Number, *");
header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
}
// OPTIONS requests are preflight requests for CORS, we can just return a 200 OK response
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: *');
header('Content-Type: application/json');
http_response_code(200);
exit;
if ($CORS === '*' || ($origin && in_array($origin, $allowed_origins))) {
header("Access-Control-Allow-Origin: " . ($origin ?: '*'));
header("Access-Control-Allow-Credentials: true");
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: *');
header('Content-Type: application/json');
http_response_code(200);
exit;
}
}
require_once 'config.php';
/** Debug */
if ($DEBUG) {
ini_set('display_errors', 1);
services/nginx/app/routes/optionsRoute.php
+14 -5
View File
@@ -12,11 +12,20 @@ class optionsRoute
{
// When the OPTIONS method is requested, accept all using regex
$this->options('/.*', function () {
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: *');
header('Content-Type: application/json');
http_response_code(200);
global $CORS;
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
$allowed_origins = array_map('trim', explode(',', (string)($CORS ?? '*')));
if ($CORS === '*' || ($origin && in_array($origin, $allowed_origins))) {
header("Access-Control-Allow-Origin: " . ($origin ?: '*'));
header("Access-Control-Allow-Credentials: true");
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: *');
header('Content-Type: application/json');
http_response_code(200);
} else {
http_response_code(403);
echo json_encode(['success' => false, 'message' => 'CORS origin not allowed']);
}
});
}
}
services/traefik/dynamic.yml
+2
View File
@@ -79,11 +79,13 @@ http:
accessControlMaxAge: 86400
accessControlAllowOriginList:
- "https://truckwash.io"
- "https://www.truckwash.io"
- "https://api.truckwash.io"
- "https://api.truckwash.io:4433"
- "https://web.truckwash.dk"
- "https://api.truckwash.dk"
- "https://truckwash.dk"
- "https://www.truckwash.dk"
- "https://staging.truckwash.io"
- "http://localhost"
- "https://localhost"