offline-gmbh / oc-cors-plugin Goto Github PK

View Code? Open in Web Editor NEW

12.0 3.0 6.0 30 KB

Setup and manage Cross-Origin Resource Sharing headers in October CMS

License: MIT License

PHP 100.00%

octobercms cors-plugin octobercms-plugin

oc-cors-plugin's Introduction

CORS plugin for October CMS

This plugin is based on https://github.com/barryvdh/laravel-cors.

All configuration for the plugin can be done via the backend settings.

The following cors headers are supported:

Access-Control-Allow-Origin
Access-Control-Allow-Headers
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
Access-Control-Expose-Headers
Access-Control-Max-Age

Currently these headers are sent for every request. There is no per-route configuration possible at this time.

Setup

After installing the plugin visit the CORS settings page in your October CMS backend settings.

You can add * as an entry to Allowed origins, Allowed headers and Allowed methods to allow any kind of CORS request from everywhere.

It is advised to be more explicit about these settings. You can add values for each header via the repeater fields.

It is important to set these intial settings once for the plugin to work as excpected!

Filesystem configuration

As an alternative to the backend settings you can create a config/config.php file in the plugins root directory to configure it.

The filesystem configuration will overwrite any defined backend setting.

<?php
// plugins/offline/cors/config/config.php
return [
    'supportsCredentials'         => true,
    'maxAge'                      => 3600,
    'allowedOrigins'              => ['*'],
    'allowedHeaders'              => ['*'],
    'allowedMethods'              => ['GET', 'POST'],
    'exposedHeaders'              => [''],
    'preflightResponseStatusCode' => 204,
];

oc-cors-plugin's People

Contributors

Stargazers

Watchers

Forkers

janlycn xmelic8 webbati dheia huynhnamegal initbiz

oc-cors-plugin's Issues

L5.5 Class CORS does not exist

The plugin has been working fine pre Laravel 5.5 upgrade. After the upgrade I get the error Class cors does not exist. I have tried to fix it but I dont know enough about the way that service providers work and so now I am stuck.

Thanks

CorsService exception on October CMS 2

Description:

Offline.Cors plugin throws an exception:

in_array() expects parameter 2 to be array, null given

~/plugins/offline/cors/classes/CorsService.php line 33

Environment:

October CMS 2.1.17
Offline.CORS 1.0.6
PHP 7.4.22 (also on PHP 7.4.4)

How to reproduce:

Install the plugin.
On the backend > Settings > CORS-Settings page, add an entry to the Allowed Origins repeater and save.
The above exception occurs.

Additional info:

I tried to print the content of the $options array (CorsService.php line#23) and got the following:

[2021-10-27 02:44:49] local.DEBUG: array (
  'supportsCredentials' => false,
  'allowedOrigins' => NULL,
  'allowedHeaders' => NULL,
  'allowedMethods' => NULL,
  'exposedHeaders' => NULL,
  'maxAge' => 0,
)

Looks like the allowed* entries should be an empty array but became NULL instead for some reason.

Composer support and config files

Great work on this plugin @tobias-kuendig! Would you be willing to add composer support and post it on Packagist?

Also, would it be possible to set it up to pull it's settings from a configuration file as well? These two changes make it easier to integrate with fully git managed projects. Let me know if you're willing to make those changes or if you'd be willing to merge them if I made a PR.

Exception in backend

HI,

I just installed the plugin, and when I try to set the CORS settings from the backend, I am having this popup:
on line 940 of /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Application.php

Any idea what is happening please?
Thanks in advance

[featureRequest]: Route White|Black list configuration

Just putting this here for now, I know this plugin doesn't support it yet.

I would love to see the ability to define either a whitelist or a blacklist of routes that would have the CORS headers enabled on them. If I have some time at some point, is this a feature that you would welcome?

Local & Production Issues

Hello,

I have some font files hosted on Rackspace CDN and I'm getting the CORS warning so I found your plugin.

Locally it doesn't seem to work, I still get the blocked warning and fonts are being pulled through.

On production, I can't even sent any origins due to an error. When I click Add new item

"" on line 882 of /home/forge/default/vendor/laravel/framework/src/Illuminate/Foundation/Application.php

Any idea what could be the issue with either?

Thanks

I just noticed that when I go to CMS and click on a page to update the same error on line 882 appears.

User login

How can I do to use this plugin to login users?
After search for routes with php artisan route:list I see this url:

user/login

but cors do not working for this url...
Im using a app ionic to try do login and the error is:

from origin 'http://localhost:8100' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I dont know how can I solve this. Im working trying solve this several days
Please, could you help me?

CORS Preflight Did Not Succeed with routes

Hello, I'm using your CORS plugin on October and a Vue application for Frontend with axios. It was previously working with https://octobercms.com/plugin/rluders-cors but due to dependencies problems with October, I moved to your plugin and https://octobercms.com/plugin/vdomah-jwtauth

In Firefox console I get : "CORS Preflight Did Not Succeed" and "Cross-Origin Request Blocked" when I call a route declared in my plugin/route.php.
Could it be a problem with JWT or CORS ? CORS has :

"Allowed origins":*
"Allowed headers":*
Supports credentials : ON

In October, my plugin, I have a route.php with :

Route::post('Change-Pwd', function (\Request $request) {
return response()->json(('The test was successful'));
})->middleware('\Tymon\JWTAuth\Middleware\GetUserFromToken');

Typing directly the URL, I get a 404 error.
With axios I get the CORS error.

Thanks for your help, I'm searching since a long time...