You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> Note: This is a standalone fork of https://github.com/asm89/stack-cors and is compatible with the options for CorsService.
18
18
## Installation
19
19
20
20
Require `fruitcake/php-cors` using composer.
@@ -35,16 +35,18 @@ This package can be used as a library. You can use it in your framework using:
35
35
| allowedOrigins | Matches the request origin. |`[]`|
36
36
| allowedOriginsPatterns | Matches the request origin with `preg_match`. |`[]`|
37
37
| allowedHeaders | Sets the Access-Control-Allow-Headers response header. |`[]`|
38
-
| exposedHeaders | Sets the Access-Control-Expose-Headers response header. |`false`|
39
-
| maxAge | Sets the Access-Control-Max-Age response header. |`false`|
38
+
| exposedHeaders | Sets the Access-Control-Expose-Headers response header. |`[]`|
39
+
| maxAge | Sets the Access-Control-Max-Age response header. |`0`|
40
40
| supportsCredentials | Sets the Access-Control-Allow-Credentials header. |`false`|
41
41
42
42
The _allowedMethods_ and _allowedHeaders_ options are case-insensitive.
43
43
44
-
You don't need to provide both _allowedOrigins_ and _allowedOriginsPatterns_. If one of the strings passed matches, it is considered a valid origin.
44
+
You don't need to provide both _allowedOrigins_ and _allowedOriginsPatterns_. If one of the strings passed matches, it is considered a valid origin. A wildcard in allowedOrigins will be converted to a pattern.
45
45
46
46
If `['*']` is provided to _allowedMethods_, _allowedOrigins_ or _allowedHeaders_ all methods / origins / headers are allowed.
47
47
48
+
> Note: Allowing a single static origin will improve cacheability.
49
+
48
50
### Example: using the library
49
51
50
52
```php
@@ -55,10 +57,10 @@ use Fruitcake\Cors\CorsService;
0 commit comments