From 76aa6502dbda919839b77783f97e772cf8bffaa1 Mon Sep 17 00:00:00 2001 From: Alejandro Celaya Date: Sun, 24 Jan 2021 09:22:46 +0100 Subject: [PATCH] Changed value returned in Access-Control-Allow-Origin so that it is always set to '*' --- module/Rest/src/Middleware/CrossDomainMiddleware.php | 2 +- module/Rest/test-api/Middleware/CorsTest.php | 2 +- module/Rest/test/Middleware/CrossDomainMiddlewareTest.php | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/module/Rest/src/Middleware/CrossDomainMiddleware.php b/module/Rest/src/Middleware/CrossDomainMiddleware.php index b438f7ec..851dc955 100644 --- a/module/Rest/src/Middleware/CrossDomainMiddleware.php +++ b/module/Rest/src/Middleware/CrossDomainMiddleware.php @@ -32,7 +32,7 @@ class CrossDomainMiddleware implements MiddlewareInterface, RequestMethodInterfa } // Add Allow-Origin header - $response = $response->withHeader('Access-Control-Allow-Origin', $request->getHeader('Origin')); + $response = $response->withHeader('Access-Control-Allow-Origin', '*'); if ($request->getMethod() !== self::METHOD_OPTIONS) { return $response; } diff --git a/module/Rest/test-api/Middleware/CorsTest.php b/module/Rest/test-api/Middleware/CorsTest.php index a1ca9901..1cb8676f 100644 --- a/module/Rest/test-api/Middleware/CorsTest.php +++ b/module/Rest/test-api/Middleware/CorsTest.php @@ -35,7 +35,7 @@ class CorsTest extends ApiTestCase ]); self::assertEquals($expectedStatusCode, $resp->getStatusCode()); - self::assertEquals($origin, $resp->getHeaderLine('Access-Control-Allow-Origin')); + self::assertEquals('*', $resp->getHeaderLine('Access-Control-Allow-Origin')); self::assertFalse($resp->hasHeader('Access-Control-Allow-Methods')); self::assertFalse($resp->hasHeader('Access-Control-Max-Age')); self::assertFalse($resp->hasHeader('Access-Control-Allow-Headers')); diff --git a/module/Rest/test/Middleware/CrossDomainMiddlewareTest.php b/module/Rest/test/Middleware/CrossDomainMiddlewareTest.php index 907fb678..08657992 100644 --- a/module/Rest/test/Middleware/CrossDomainMiddlewareTest.php +++ b/module/Rest/test/Middleware/CrossDomainMiddlewareTest.php @@ -61,7 +61,7 @@ class CrossDomainMiddlewareTest extends TestCase $headers = $response->getHeaders(); - self::assertEquals('local', $response->getHeaderLine('Access-Control-Allow-Origin')); + self::assertEquals('*', $response->getHeaderLine('Access-Control-Allow-Origin')); self::assertArrayNotHasKey('Access-Control-Allow-Methods', $headers); self::assertArrayNotHasKey('Access-Control-Max-Age', $headers); self::assertArrayNotHasKey('Access-Control-Allow-Headers', $headers); @@ -82,7 +82,7 @@ class CrossDomainMiddlewareTest extends TestCase $headers = $response->getHeaders(); - self::assertEquals('local', $response->getHeaderLine('Access-Control-Allow-Origin')); + self::assertEquals('*', $response->getHeaderLine('Access-Control-Allow-Origin')); self::assertArrayHasKey('Access-Control-Allow-Methods', $headers); self::assertEquals('1000', $response->getHeaderLine('Access-Control-Max-Age')); self::assertEquals('foo, bar, baz', $response->getHeaderLine('Access-Control-Allow-Headers'));