Cors

Middleware that adds CORS headers for origins allowed by configuration.

class Cors implements \Hazaar\Middleware\Interface\Middleware

Implements: Hazaar\Middleware\Interface\Middleware

Reads its allow-list from the cors config section:

'cors' => [
    'allowedOrigins' => ['https://example.com'],
    'allowedMethods' => ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
    'allowedHeaders' => ['Content-Type', 'Authorization'],
],

allowedOrigins also accepts a comma-separated string, which is convenient when the value is injected at build/deploy time via environment variable substitution. When no origins are configured, this middleware is a no-op.

A single '*' entry in allowedOrigins allows every origin. This is safe to combine with routes that also accept cookie/session auth: this middleware never sets Access-Control-Allow-Credentials, so browsers won't expose a credentialed (cookie-bearing) cross-origin response regardless of how permissive allowedOrigins is -- only header-based auth (e.g. a bearer token a caller attaches explicitly) can actually be used cross-origin under this policy.

Methods

handle

public handle(Request $request, callable $next, mixed $args): Response

Returns: Hazaar\Controller\Response

Parameters

Parameter	Type	Description
$request	Hazaar\Application\Request
$next	callable
$args	mixed

isOriginAllowed

public isOriginAllowed(?string $origin, array $allowedOrigins): bool

Returns: bool

Parameters

Parameter	Type	Description
$origin	string
$allowedOrigins	array

---

Generated by Hazaar API Doc Generator on Thu, 22 Oct 2026 05:05:30 +0000