如何优雅地解决跨域请求（CORS）问题：使用Composer轻松集成neomerx/cors-psr7

localhost:8080

localhost:80

localhost:8000

GET

POST

Access to XMLHttpRequest at 'http://localhost:8000/api/data' from origin 'http://localhost:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

neomerx/cors-psr7

neomerx/cors-psr7

<pre class="brush:php;toolbar:false;">composer require neomerx/cors-psr7

neomerx/cors-psr7

neomerx/cors-psr7

neomerx/cors-psr7

<pre class="brush:php;toolbar:false;"><?php

require 'vendor/autoload.php'; // 引入 Composer 自动加载

use Neomerx\Cors\Analyzer;
use Neomerx\Cors\Contracts\AnalysisResultInterface;
use Neomerx\Cors\Strategies\Settings;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Message\ResponseInterface;
use GuzzleHttp\Psr7\Response; // 假设你使用 Guzzle PSR-7 响应

// 模拟一个处理请求的函数，实际中可能是你的路由或控制器
function handleRequest(ServerRequestInterface $request, ResponseInterface $response): ResponseInterface
{
    // 这里是你的业务逻辑，例如返回一些 JSON 数据
    $response->getBody()->write(json_encode(['message' => 'Hello from API!']));
    return $response->withHeader('Content-Type', 'application/json');
}

// 1. 定义 CORS 策略设置
$corsSettings = (new Settings())
    ->setServerOrigin('http', 'localhost', 8000) // 你的API服务器地址
    ->setPreFlightCacheMaxAge(86400) // 预检请求结果缓存一天
    ->setCredentialsSupported() // 允许携带 Cookie 等凭证
    ->setAllowedOrigins(['http://localhost:8080', 'https://your-frontend.com']) // 允许的前端域名
    ->setAllowedMethods(['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS']) // 允许的HTTP方法
    ->setAllowedHeaders(['Content-Type', 'Authorization', 'X-Requested-With']) // 允许的请求头
    ->setExposedHeaders(['X-Custom-Header']); // 允许浏览器访问的响应头

// 2. 实例化 CORS 分析器
$corsAnalyzer = Analyzer::instance($corsSettings);

// 3. 获取当前的请求 (实际中可能从你的框架或 PSR-7 ServerRequestFactory 获取)
// 这里我们模拟一个请求，你需要替换为实际的请求对象
$request = GuzzleHttp\Psr7\ServerRequest::fromGlobals();

// 4. 分析请求的 CORS 类型
$corsResult = $corsAnalyzer->analyze($request);

// 5. 根据分析结果处理请求
switch ($corsResult->getRequestType()) {
    case AnalysisResultInterface::ERR_NO_HOST_HEADER:
    case AnalysisResultInterface::ERR_ORIGIN_NOT_ALLOWED:
    case AnalysisResultInterface::ERR_METHOD_NOT_SUPPORTED:
    case AnalysisResultInterface::ERR_HEADERS_NOT_SUPPORTED:
        // CORS 策略不通过，返回 4xx 错误
        $response = (new Response(403))->withHeader('Content-Type', 'text/plain');
        $response->getBody()->write('Forbidden: CORS policy violation.');
        break;

    case AnalysisResultInterface::TYPE_PRE_FLIGHT_REQUEST:
        // 预检请求 (OPTIONS)，返回 200 并带上 CORS 响应头
        $response = new Response(200);
        foreach ($corsResult->getResponseHeaders() as $name => $values) {
            foreach ($values as $value) {
                $response = $response->withAddedHeader($name, $value);
            }
        }
        break;

    case AnalysisResultInterface::TYPE_REQUEST_OUT_OF_CORS_SCOPE:
        // 非跨域请求，直接进入业务逻辑
        $response = handleRequest($request, new Response());
        break;

    default:
        // 实际的跨域请求，先执行业务逻辑，再添加 CORS 响应头
        $response = handleRequest($request, new Response());
        foreach ($corsResult->getResponseHeaders() as $name => $values) {
            foreach ($values as $value) {
                $response = $response->withAddedHeader($name, $value);
            }
        }
        break;
}

// 发送响应
foreach ($response->getHeaders() as $name => $values) {
    foreach ($values as $value) {
        header(sprintf('%s: %s', $name, $value), false);
    }
}
http_response_code($response->getStatusCode());
echo (string) $response->getBody();

neomerx/cors-psr7

neomerx/cors-psr7

neomerx/cors-psr7

neomerx/cors-psr7