123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960 |
- <?php
- declare (strict_types=1);
- namespace app\common\middleware;
- use Closure;
- use think\Request;
- use think\Response;
- use think\facade\Config;
- class AllowCrossDomain
- {
- protected $header = [
- 'Access-Control-Allow-Credentials' => 'true',
- 'Access-Control-Max-Age' => 1800,
- 'Access-Control-Allow-Methods' => 'GET, POST, PATCH, PUT, DELETE, OPTIONS',
- 'Access-Control-Allow-Headers' => 'think-lang, server, ba-user-token, batoken, Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With',
- ];
-
- public function handle(Request $request, Closure $next, ?array $header = []): Response
- {
- $header = !empty($header) ? array_merge($this->header, $header) : $this->header;
- $origin = $request->header('origin');
- if ($origin) {
- $info = parse_url($origin);
-
- $corsDomain = explode(',', Config::get('buildadmin.cors_request_domain'));
- $corsDomain[] = $request->host(true);
- if (in_array("*", $corsDomain) || in_array($origin, $corsDomain) || (isset($info['host']) && in_array($info['host'], $corsDomain))) {
- header("Access-Control-Allow-Origin: " . $origin);
- }
- }
- return $next($request)->header($header);
- }
- }
|