Merge pull request #233 from dotkernel/issue_232

Replace tuupola/cors with mezzio/cors.

composer.json

@@ -62,13 +62,13 @@
         "laminas/laminas-stdlib": "^3.2",
         "mezzio/mezzio": "^3.2",
         "mezzio/mezzio-authorization-rbac": "^1.0",
+        "mezzio/mezzio-cors": "^1.0",
         "mezzio/mezzio-fastroute": "^3.0",
         "mezzio/mezzio-helpers": "^5.3",
         "mezzio/mezzio-twigrenderer": "^2.2",
         "ramsey/uuid-doctrine": "^1.6",
         "roave/psr-container-doctrine": "^2.2",
-        "robmorgan/phinx": "^0.12",
-        "tuupola/cors-middleware": "^1.1"
+        "robmorgan/phinx": "^0.12"
     },
     "require-dev": {
         "laminas/laminas-development-mode": "^3.2",

config/autoload/cors.global.php

@@ -2,16 +2,22 @@
 
 declare(strict_types=1);
 
+use Mezzio\Cors\Configuration\ConfigurationInterface;
+
 return [
-    'cors' => [
-        'origin' => ['*'],
-        'methods' => ['DELETE', 'GET', 'OPTIONS', 'PATCH', 'POST', 'PUT'],
-        'headers.allow' => ['Accept', 'Content-Type', 'Authorization'],
-        'headers.expose' => [],
-        'credentials' => false,
-        'cache' => 0,
-        'error' => [
-            Frontend\App\Factory\CorsFactory::class, 'error'
-        ]
+    ConfigurationInterface::CONFIGURATION_IDENTIFIER => [
+        'allowed_origins' => [
+            /**
+             * Leaving this line here makes your application accessible by any origin.
+             *
+             * To restrict, replace this line with a list of origins that should have access to your application.
+             * Example: "domain1.com", "domain2.com"
+             */
+            ConfigurationInterface::ANY_ORIGIN
+        ],
+        'allowed_headers' => ['Accept', 'Content-Type', 'Authorization'], // Custom headers
+        'allowed_max_age' => '600', // 10 minutes
+        'credentials_allowed' => true, // Allow cookies
+        'exposed_headers' => [], // Tell client that the API will always return this header
     ],
 ];

config/autoload/dependencies.global.php

@@ -5,7 +5,6 @@
 use Dot\Mail\Factory\MailOptionsAbstractFactory;
 use Dot\Mail\Factory\MailServiceAbstractFactory;
 use Dot\Mail\Service\MailService;
-use Frontend\App\Factory\CorsFactory;
 use Dot\ErrorHandler\ErrorHandlerInterface;
 use Dot\ErrorHandler\LogErrorHandler;
 use Frontend\App\Middleware\AuthMiddleware;
@@ -33,7 +32,6 @@
         'factories'  => [
             'dot-mail.options.default' => MailOptionsAbstractFactory::class,
             'dot-mail.service.default' => MailServiceAbstractFactory::class,
-            Tuupola\Middleware\CorsMiddleware::class => CorsFactory::class,
             AuthMiddleware::class => AuthMiddlewareFactory::class,
         ],
     ],

config/config.php

@@ -14,6 +14,7 @@
 
 $aggregator = new ConfigAggregator([
     \Laminas\HttpHandlerRunner\ConfigProvider::class,
+    \Laminas\Diactoros\ConfigProvider::class,
     \Mezzio\Twig\ConfigProvider::class,
     \Mezzio\Router\FastRouteRouter\ConfigProvider::class,
     // Include cache configuration
@@ -22,6 +23,7 @@
     \Mezzio\Helper\ConfigProvider::class,
     \Mezzio\ConfigProvider::class,
     \Mezzio\Router\ConfigProvider::class,
+    \Mezzio\Cors\ConfigProvider::class,
 
     // Swoole config to overwrite some services (if installed)
     class_exists(\Mezzio\Swoole\ConfigProvider::class)

config/pipeline.php

@@ -5,6 +5,7 @@
 use Dot\ErrorHandler\ErrorHandlerInterface;
 use Dot\ResponseHeader\Middleware\ResponseHeaderMiddleware;
 use Mezzio\Application;
+use Mezzio\Cors\Middleware\CorsMiddleware;
 use Mezzio\Handler\NotFoundHandler;
 use Mezzio\Helper\ServerUrlMiddleware;
 use Mezzio\Helper\UrlHelperMiddleware;
@@ -15,7 +16,6 @@
 use Mezzio\Router\Middleware\MethodNotAllowedMiddleware;
 use Mezzio\Router\Middleware\RouteMiddleware;
 use Psr\Container\ContainerInterface;
-use Tuupola\Middleware\CorsMiddleware;
 use Frontend\App\Middleware\TranslatorMiddleware;
 use Dot\Rbac\Guard\Middleware\ForbiddenHandler;
 use Dot\Rbac\Guard\Middleware\RbacGuardMiddleware;