On his blog today Freek Van der Herten has a post introducing a new Laravel package designed to help make CORS implementation simpler in your application. CORS headers are, essentially, what allows clients (like browsers) to talk across domains in a configurable and enforceable fashion.

Recently we released laravel-cors. This package can add the necessary CORS headers of your Laravel app. In this post I'd like to give a quick explanation of what CORS is and how you can use the package.

The post starts by explaining a bit about CORS (Cross-Origin Resource Sharing) headers, what they're used for and simple examples of when they might be most useful. It then covers the package, showing how to pull it into your packages and adding it to the middleware configuration for loading on each request. There's also a more detailed configuration you can use to defined allowed and denied domains as well as the idea of "profiles" for different user levels.

In a new post to his site Rob Allen shows you how to implement CORS in a Zend Expressive application through the use of a simple middleware wrapper that sends the appropriate headers.

On a recent project, I needed to implement CORS support for my Expressive API. The easiest way to do this is to use Mike Tuupola's PSR-7 CORS Middleware.

As this is a standard Slim-Style PSR-7 middleware implementation, we need to wrap it for Expressive, so we make a factory. [...] We then register this in our AppConfigProvider::getDependencies() by adding to the factories key.

He includes the code and configuration changes required to make it all work and includes example output of a request (with headers) from a curl call to the API. He also includes a section on working with JSON error responses and ProblemDetails for when there are issues related to the current CORS policy definition.

In this post to his site Joshua Sampia shows how to set up and configure CORS in your Slim-based application. CORS or Cross-Origin Resource Sharing, lets you further lock down what sources can access your application and some requirements around the ones that can.

Ok, another PHP post but this time it’s about setting up some middleware for a slim PHP application.

Let me set this up. We are building a simple REST API for use with a basic phone native app (both Android and iOS). Me being new to this, I wasn’t sure if the native app domain call is considered cross browser or not, plus there are some outside companies we are working with who MAY access the API as well. [...] I setup some middleware by extending the Slim Middleware class and adding them via the app.

He talks about the steps he had to take in the middleware to set up an AccessControlOrigin middleware (and two others requiring HTTPS and HTTP Basic Auth). He includes the simple code to send the required HTTP headers to support CORS on the response object and the update to his Javascript to include credentials with every request.

In his latest post David Müller covers some of the things to consider when working with cross-domain ajax requests including CORS and iframes.

As it is widely known, AJAX Requests are only possible if port, protocol and domain of sender and receiver are equal. [...] Having this cleared out, we will cover ways around this restriction.

He covers three main approaches to allowing these cross-domain requests (and some of the security implications that can come with them):

• CORS (Cross Origin Resource Sharing)
• JSONP (Javascript with a local domain callback)
• Iframes

He also briefly mentions things like window.postMessage (HTML5) and the use of a backend script to proxy a request into your application's local code.