PHPackages                             leafs/cors - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Framework](/categories/framework)
4. /
5. leafs/cors

ActiveLibrary[Framework](/categories/framework)

leafs/cors
==========

Leaf PHP cors config

v1.2(1y ago)220.0k↓26.2%[3 issues](https://github.com/leafsphp/cors/issues)4MITPHP

Since Sep 22Pushed 1y ago1 watchersCompare

[ Source](https://github.com/leafsphp/cors)[ Packagist](https://packagist.org/packages/leafs/cors)[ Docs](https://leafphp.netlify.app/#/)[ GitHub Sponsors](https://github.com/leafsphp)[ Fund](https://opencollective.com/leaf)[ RSS](/packages/leafs-cors/feed)WikiDiscussions main Synced 1mo ago

READMEChangelog (4)Dependencies (1)Versions (5)Used By (4)

 [![](https://camo.githubusercontent.com/e83224618735d048f0f70f04e02d7973a634a055e18d47fe22501e3a85e40b9f/68747470733a2f2f6c6561667068702e6e65746c6966792e6170702f6173736574732f696d672f6c656166332d6c6f676f2e706e67)](https://camo.githubusercontent.com/e83224618735d048f0f70f04e02d7973a634a055e18d47fe22501e3a85e40b9f/68747470733a2f2f6c6561667068702e6e65746c6966792e6170702f6173736574732f696d672f6c656166332d6c6f676f2e706e67)

Leaf Cors Module
================

[](#leaf-cors-module)

Leaf PHP
========

[](#leaf-php)

[![Latest Stable Version](https://camo.githubusercontent.com/59146b721222a6faa92071a09e54c85175e38f358da26caaa244c585acc785d7/68747470733a2f2f706f7365722e707567782e6f72672f6c656166732f636f72732f762f737461626c65)](https://packagist.org/packages/leafs/cors)[![Total Downloads](https://camo.githubusercontent.com/839da6b8379e268524a672cb59acf54d54b6688add6e546baf96af9edb69a2b2/68747470733a2f2f706f7365722e707567782e6f72672f6c656166732f636f72732f646f776e6c6f616473)](https://packagist.org/packages/leafs/cors)[![License](https://camo.githubusercontent.com/b30ba3ef45c3439d1610864cbb7a4f1565874815fcffe0134e7d6bf1b7bfe810/68747470733a2f2f706f7365722e707567782e6f72672f6c656166732f636f72732f6c6963656e7365)](https://packagist.org/packages/leafs/cors)

This is the CORS handler for Leaf.

Installation
------------

[](#installation)

You can easily install it using [leaf cli](https://cli.leafphp.dev)

```
leaf install cors
```

or with [Composer](https://getcomposer.org/):

```
composer require leafs/cors
```

Usage
-----

[](#usage)

After installing the cors module, the cors module is automatically linked to the leaf app and can be used directly without referencing it anywhere.

### Simple Usage (Enable *All* CORS Requests)

[](#simple-usage-enable-all-cors-requests)

```
require __DIR__ . "/vendor/autoload.php";

$app = new Leaf\App;

$app->cors();

$app->get('/products/{id}', function () use($app) {
  $app->response()->json(['message' => 'This is CORS-enabled for all origins!']);
});

$app->run();
```

You can alternatively call `Leaf\Http\Cors::config()` instead of `$app->cors()` in the example above.

### Configuring CORS

[](#configuring-cors)

```
require __DIR__ . '/vendor/autoload.php';

$app = new Leaf\App;

$app->cors([
  'origin' => 'http://example.com',
  'optionsSuccessStatus' => 200 // some legacy browsers (IE11, various SmartTVs) choke on 204
]);

$app->get('/products/{id}', function () use($app) {
  $app->response()->json(['message' => 'This is CORS-enabled for all origins!']);
});

$app->run();
```

Configuration Options
---------------------

[](#configuration-options)

- `origin`: Configures the **Access-Control-Allow-Origin** CORS header. Possible values:
    - `String` - set `origin` to a specific origin. For example if you set it to `"http://example.com"` only requests from "" will be allowed.
    - `RegExp (in string form)` - set `origin` to a regular expression pattern which will be used to test the request origin. If it's a match, the request origin will be reflected. For example the pattern `'/example\.com$/'` will reflect any request that is coming from an origin ending with "example.com".
    - `Array` - set `origin` to an array of valid origins. Each origin can be a `String` or a `RegExp`. For example `["http://example1.com", '/\.example2\.com$/']` will accept any request from "" or from a subdomain of "example2.com".
    - `Function` - set `origin` to a function implementing some custom logic. The function takes the request origin as the first parameter and a callback (called as `callback(err, origin)`, where `origin` is a non-function value of the `origin` option) as the second.
- `methods`: Configures the **Access-Control-Allow-Methods** CORS header. Expects a comma-delimited string (ex: 'GET,PUT,POST') or an array (ex: `['GET', 'PUT', 'POST']`).
- `allowedHeaders`: Configures the **Access-Control-Allow-Headers** CORS header. Expects a comma-delimited string (ex: 'Content-Type,Authorization') or an array (ex: `['Content-Type', 'Authorization']`). If not specified, defaults to reflecting the headers specified in the request's **Access-Control-Request-Headers** header.
- `exposedHeaders`: Configures the **Access-Control-Expose-Headers** CORS header. Expects a comma-delimited string (ex: 'Content-Range,X-Content-Range') or an array (ex: `['Content-Range', 'X-Content-Range']`). If not specified, no custom headers are exposed.
- `credentials`: Configures the **Access-Control-Allow-Credentials** CORS header. Set to `true` to pass the header, otherwise it is omitted.
- `maxAge`: Configures the **Access-Control-Max-Age** CORS header. Set to an integer to pass the header, otherwise it is omitted.
- `preflightContinue`: Pass the CORS preflight response to the next handler.
- `optionsSuccessStatus`: Provides a status code to use for successful `OPTIONS` requests, since some legacy browsers (IE11, various SmartTVs) choke on `204`.

The default configuration is the equivalent of:

```
{
  "origin": "*",
  "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
  "allowedHeaders": "*",
  "exposedHeaders": "",
  "credentials": false,
  "maxAge": null,
  "preflightContinue": false,
  "optionsSuccessStatus": 204,
}
```

###  Health Score

31

—

LowBetter than 68% of packages

Maintenance16

Infrequent updates — may be unmaintained

Popularity28

Limited adoption so far

Community15

Small or concentrated contributor base

Maturity53

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 83.3% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~366 days

Total

4

Last Release

598d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/29547806?v=4)[Mychi](/maintainers/Mychi)[@mychi](https://github.com/mychi)

---

Top Contributors

[![mychidarko](https://avatars.githubusercontent.com/u/26604242?v=4)](https://github.com/mychidarko "mychidarko (15 commits)")[![ryangunn313](https://avatars.githubusercontent.com/u/86926422?v=4)](https://github.com/ryangunn313 "ryangunn313 (3 commits)")

---

Tags

corsleafphpphpphpframeworkcorsCross-Origin Resource Sharingoriginleaf

### Embed Badge

![Health badge](/badges/leafs-cors/health.svg)

```
[![Health](https://phpackages.com/badges/leafs-cors/health.svg)](https://phpackages.com/packages/leafs-cors)
```

###  Alternatives

[leafs/leaf

Elegant PHP for modern developers

1.3k44.3k9](/packages/leafs-leaf)[patricksavalle/slim-rest-api

Production-grade REST-API App-class for PHP SLIM, in production on https://zaplog.pro (https://api.zaplog.pro/v1)

101.4k](/packages/patricksavalle-slim-rest-api)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)