PHPackages laminas-commons/lmc-cors - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [HTTP & Networking](/categories/http) 4. / 5. laminas-commons/lmc-cors Abandoned → [lm-commons/lmc-cors](/?search=lm-commons%2Flmc-cors)ArchivedLibrary[HTTP & Networking](/categories/http) laminas-commons/lmc-cors ======================== Laminas MVC module that let you deal with CORS requests v1.0.2(5y ago)217.0k↓50%3[2 issues](https://github.com/Laminas-Commons/LmcCors/issues)MITPHPPHP ^7.2 Since Sep 7Pushed 5y ago2 watchersCompare [ Source](https://github.com/Laminas-Commons/LmcCors)[ Packagist](https://packagist.org/packages/laminas-commons/lmc-cors)[ Docs](https://github.com/lmainas-commons/lmc-cors)[ RSS](/packages/laminas-commons-lmc-cors/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (3)Dependencies (12)Versions (5)Used By (0) > **Important:** This library is abandoned. > Please use [LM-Commons/LmcCors](https://github.com/LM-Commons/LmcCors). LmcCors ======= [](#lmccors) [![Build Status](https://camo.githubusercontent.com/0e339ff604abaeb0885a0e06822c958054afc18d83bae1504acbf7754bd8955d/68747470733a2f2f7472617669732d63692e636f6d2f4c616d696e61732d436f6d6d6f6e732f6c6d63636f72732e7376673f6272616e63683d6d6173746572)](https://travis-ci.com/Laminas-Commons/lmccors)[![Scrutinizer Code Quality](https://camo.githubusercontent.com/c80726e3c8db3bc32cc2c709d359e6b3e4d376bcbe00d1403ed768a06acd6220/68747470733a2f2f7363727574696e697a65722d63692e636f6d2f672f4c616d696e61732d436f6d6d6f6e732f4c6d63436f72732f6261646765732f7175616c6974792d73636f72652e706e673f623d6d6173746572)](https://scrutinizer-ci.com/g/Laminas-Commons/LmcCors/?branch=master)[![Coverage Status](https://camo.githubusercontent.com/19f105626688888188b189b6921718231601212125f139f8cdb693f9cd53e732/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f4c616d696e61732d436f6d6d6f6e732f4c6d63436f72732f62616467652e7376673f6272616e63683d6d6173746572)](https://coveralls.io/github/Laminas-Commons/LmcCors?branch=master)[![Latest Stable Version](https://camo.githubusercontent.com/1a61cb0b0759d0783072ef53b68bbede55f6a2e7f0a6eec7b78edc3a5a5bfdf1/68747470733a2f2f706f7365722e707567782e6f72672f6c616d696e61732d636f6d6d6f6e732f6c6d632d636f72732f76)](//packagist.org/packages/laminas-commons/lmc-cors)[![License](https://camo.githubusercontent.com/54f745ebbbf1f6e6559823914e9cb2fa122e134a50219d7929ae7332494f2df1/68747470733a2f2f706f7365722e707567782e6f72672f6c616d696e61732d636f6d6d6f6e732f6c6d632d636f72732f6c6963656e7365)](//packagist.org/packages/laminas-commons/lmc-cors)[![Total Downloads](https://camo.githubusercontent.com/60c1f5bb9112ddb0d7184e5d24203ab7e32cbd7549eb9e90a2629336173659c4/68747470733a2f2f706f7365722e707567782e6f72672f6c616d696e61732d636f6d6d6f6e732f6c6d632d636f72732f646f776e6c6f616473)](//packagist.org/packages/laminas-commons/lmc-cors) LmcCors is a simple Laminas MVC module that helps you to deal with Cross-Origin Resource Sharing (CORS). What is LmcCors ? ----------------- [](#what-is-lmccors-) LmcCors is a Laminas MVC module that allow to easily configure your Laminas MVC application so that it automatically builds HTTP responses that follow the CORS documentation. ### Installation [](#installation) Install the module by typing (or add it to your `composer.json` file): ``` $ php composer.phar require laminas-commons/lmc-cors ``` Then, enable it by adding "LmcCors" in your `application.config.php` or `modules.config.php` file. By default, LmcCors is configured to deny every CORS requests. To change that, you need to copy the [`config/lmc_cors.global.php.dist`](config/lmc_cors.global.php.dist) file to your `autoload` folder (remove the `.dist` extension), and modify it to suit your needs. Documentation ------------- [](#documentation) ### What is CORS ? [](#what-is-cors-) CORS is a mechanism that allows to perform cross-origin requests from your browser. For instance, let's say that your website is hosted in the domain `http://example.com`. By default, user agents won't be allowed to perform AJAX requests to another domain for security reasons (for instance `http://funny-domain.com`). With CORS, you can allow your server to reply to such requests. You can find better documentation on how CORS works on the web: - [Mozilla documentation about CORS](https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS) - [CORS server flowchart](http://www.html5rocks.com/static/images/cors_server_flowchart.png) ### Event registration [](#event-registration) LmcCors registers the `LmcCors\Mvc\CorsRequestListener` with the `MvcEvent::EVENT_ROUTE` event, with a priority of -1. This means that this listener is executed AFTER the route has been matched. ### Configuring the module [](#configuring-the-module) As by default, all the various options are set globally for all routes: - `allowed_origins`: (array) List of allowed origins. To allow any origin, you can use the wildcard (`*`) character. If multiple origins are specified, LmcCors will automatically check the `"Origin"` header's value, and only return the allowed domain (if any) in the `"Allow-Access-Control-Origin"` response header. To allow any sub-domain, you can prefix the domain with the wildcard character (i.e. `*.example.com`). Please note that you don't need to add your host URI (so if your website is hosted as "example.com", "example.com" is automatically allowed. - `allowed_methods`: (array) List of allowed HTTP methods. Those methods will be returned for the preflight request to indicate which methods are allowed to the user agent. You can even specify custom HTTP verbs. - `allowed_headers`: (array) List of allowed headers that will be returned for the preflight request. This indicates to the user agent which headers are permitted to be sent when doing the actual request. - `max_age`: (int) Maximum age (seconds) the preflight request should be cached by the user agent. This prevents the user agent from sending a preflight request for each request. - `exposed_headers`: (array) List of response headers that are allowed to be read in the user agent. Please note that some browsers do not implement this feature correctly. - `allowed_credentials`: (boolean) If true, it allows the browser to send cookies along with the request. If you want to configure specific routes, you can add `ZfrCors\Options\CorsOptions::ROUTE_PARAM` to your route configuration: ```