PHPackages                             andrewdyer/cors-response-emitter - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [HTTP & Networking](/categories/http)
4. /
5. andrewdyer/cors-response-emitter

ActiveLibrary[HTTP & Networking](/categories/http)

andrewdyer/cors-response-emitter
================================

A CORS-aware response emitter for Slim Framework applications that applies consistent CORS and cache-control headers

0.1.3(1mo ago)090MITPHPPHP ^8.3CI passing

Since Apr 7Pushed 1mo agoCompare

[ Source](https://github.com/andrewdyer/cors-response-emitter)[ Packagist](https://packagist.org/packages/andrewdyer/cors-response-emitter)[ Docs](https://github.com/andrewdyer/cors-response-emitter)[ RSS](/packages/andrewdyer-cors-response-emitter/feed)WikiDiscussions main Synced 3w ago

READMEChangelog (4)Dependencies (12)Versions (5)Used By (0)

CORS Response Emitter
=====================

[](#cors-response-emitter)

A CORS-aware response emitter for [Slim Framework](https://www.slimframework.com/) applications that applies consistent CORS and cache-control headers.

[![Latest Stable Version](https://camo.githubusercontent.com/41b57e63aafc4b782765d9967ac550d5ed94d360682342d3ada1a20b81e96cd7/687474703a2f2f706f7365722e707567782e6f72672f616e64726577647965722f636f72732d726573706f6e73652d656d69747465722f763f7374796c653d666c61742d737175617265)](https://packagist.org/packages/andrewdyer/cors-response-emitter)[![Total Downloads](https://camo.githubusercontent.com/ea190ca5be51c9514f581a82ed6bca5cabb241cb221f32f034397b188d831613/687474703a2f2f706f7365722e707567782e6f72672f616e64726577647965722f636f72732d726573706f6e73652d656d69747465722f646f776e6c6f6164733f7374796c653d666c61742d737175617265)](https://packagist.org/packages/andrewdyer/cors-response-emitter)[![License](https://camo.githubusercontent.com/49d372260cf08bdac735e48be0935b0fa1f9139039e4d212fa04dde129d0f897/687474703a2f2f706f7365722e707567782e6f72672f616e64726577647965722f636f72732d726573706f6e73652d656d69747465722f6c6963656e73653f7374796c653d666c61742d737175617265)](https://packagist.org/packages/andrewdyer/cors-response-emitter)[![PHP Version Require](https://camo.githubusercontent.com/9f2332cb9e43f14227d3812bb2ad2db26f740598e0436d647e50756d1f9e18e3/687474703a2f2f706f7365722e707567782e6f72672f616e64726577647965722f636f72732d726573706f6e73652d656d69747465722f726571756972652f7068703f7374796c653d666c61742d737175617265)](https://packagist.org/packages/andrewdyer/cors-response-emitter)

Introduction
------------

[](#introduction)

This library applies CORS and cache-control headers when emitting Slim responses. It checks the incoming request origin against an explicit allowlist, returns credentialed CORS responses for trusted origins, and supports wildcard responses for public APIs without credentials. Cache-control headers are applied consistently across emitted responses.

Prerequisites
-------------

[](#prerequisites)

- **[PHP](https://www.php.net/)**: Version 8.3 or higher is required.
- **[Composer](https://getcomposer.org/)**: Dependency management tool for PHP.
- **[Slim Framework](https://www.slimframework.com/)**: Version 4 is required.

Installation
------------

[](#installation)

```
composer require andrewdyer/cors-response-emitter
```

Getting Started
---------------

[](#getting-started)

The examples below demonstrate how to configure the emitter and emit a Slim response with CORS headers.

### 1. Configure trusted origins

[](#1-configure-trusted-origins)

Provide an allowlist of origins that may receive credentialed CORS responses.

```
use AndrewDyer\CorsResponseEmitter\CorsResponseEmitter;

$emitter = new CorsResponseEmitter([
    'https://app.example.com',
    'https://admin.example.com',
]);
```

### 2. Emit the response

[](#2-emit-the-response)

After Slim handles the request, pass the response to the emitter.

```
$emitter->emit($response);
```

Usage
-----

[](#usage)

The emitter resolves CORS headers from the request origin and allowlist configuration:

Scenario`Access-Control-Allow-Origin``Access-Control-Allow-Credentials``Vary`Request origin matches an explicit allowlist entryReflected origin (e.g. `https://app.example.com`)`true``Origin``"*"` in allowlist, no explicit match`*`*(omitted)**(omitted)*No match and no wildcard allowlist entry*(omitted)**(omitted)**(omitted)*### Allow exact origins

[](#allow-exact-origins)

Use explicit origins when endpoints need credentialed cross-origin requests.

```
use AndrewDyer\CorsResponseEmitter\CorsResponseEmitter;

$emitter = new CorsResponseEmitter([
    'https://app.example.com',
    'https://admin.example.com',
]);
$emitter->emit($response);
```

### Allow any origin for public APIs

[](#allow-any-origin-for-public-apis)

A wildcard origin (`"*"`) may be configured as an allowlist entry to permit requests from any origin. This is suitable for fully public, unauthenticated APIs:

```
use AndrewDyer\CorsResponseEmitter\CorsResponseEmitter;

$emitter = new CorsResponseEmitter(['*']);
$emitter->emit($response);
```

### Combine exact and wildcard origins

[](#combine-exact-and-wildcard-origins)

Explicit origins and `"*"` may be combined. An exact match always takes precedence and receives the credentialed response. Requests from any other origin fall back to the uncredentialed wildcard response:

```
use AndrewDyer\CorsResponseEmitter\CorsResponseEmitter;

$emitter = new CorsResponseEmitter([
    '*',
    'https://app.example.com', // receives credentialed response
]);
$emitter->emit($response);
```

Important: the [CORS specification](https://fetch.spec.whatwg.org/#cors-protocol-and-credentials) forbids sending `Access-Control-Allow-Credentials: true` with `Access-Control-Allow-Origin: *`. If an endpoint requires cookies, HTTP authentication, or client certificates, use explicit origins.

Complete Example
----------------

[](#complete-example)

The following example combines Slim setup, request handling, and CORS-aware response emission:

```