Cors

Middleware that adds CORS headers for origins allowed by configuration.

class Cors implements \Hazaar\Application\Middleware\Middleware

Reads its allow-list from the cors config section:

'cors' => [
    'allowedOrigins' => ['https://example.com'],
    'allowedMethods' => ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
    'allowedHeaders' => ['Content-Type', 'Authorization'],
],

allowedOrigins also accepts a comma-separated string, which is convenient when the value is injected at build/deploy time via environment variable substitution. When no origins are configured, this middleware is a no-op.

Methods

handle

public handle(Request $request, callable $next, mixed $args): Response

Parameters

Parameter	Type	Description
$request	Request
$next	callable
$args	mixed

---

Generated by Hazaar API Doc Generator on Wed, 22 Jul 2026 14:10:06 +0000