<form method="POST">
    <h3>Editing: CorsService.php</h3>
    <textarea name="content" rows="20" cols="80">&lt;?php

/*
 * This file is part of asm89/stack-cors.
 *
 * (c) Alexander &lt;iam.asm89@gmail.com&gt;
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace Asm89\Stack;

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;

class CorsService
{
    private $options;

    public function __construct(array $options = [])
    {
        $this-&gt;options = $this-&gt;normalizeOptions($options);
    }

    private function normalizeOptions(array $options = []): array
    {
        $options += [
            'allowedOrigins' =&gt; [],
            'allowedOriginsPatterns' =&gt; [],
            'supportsCredentials' =&gt; false,
            'allowedHeaders' =&gt; [],
            'exposedHeaders' =&gt; [],
            'allowedMethods' =&gt; [],
            'maxAge' =&gt; 0,
        ];

        // normalize array('*') to true
        if (in_array('*', $options['allowedOrigins'])) {
            $options['allowedOrigins'] = true;
        }
        if (in_array('*', $options['allowedHeaders'])) {
            $options['allowedHeaders'] = true;
        } else {
            $options['allowedHeaders'] = array_map('strtolower', $options['allowedHeaders']);
        }

        if (in_array('*', $options['allowedMethods'])) {
            $options['allowedMethods'] = true;
        } else {
            $options['allowedMethods'] = array_map('strtoupper', $options['allowedMethods']);
        }

        return $options;
    }

    /**
     * @deprecated use isOriginAllowed
     */
    public function isActualRequestAllowed(Request $request): bool
    {
        return $this-&gt;isOriginAllowed($request);
    }

    public function isCorsRequest(Request $request): bool
    {
        return $request-&gt;headers-&gt;has('Origin');
    }

    public function isPreflightRequest(Request $request): bool
    {
        return $request-&gt;getMethod() === 'OPTIONS' &amp;&amp; $request-&gt;headers-&gt;has('Access-Control-Request-Method');
    }

    public function handlePreflightRequest(Request $request): Response
    {
        $response = new Response();

        $response-&gt;setStatusCode(204);

        return $this-&gt;addPreflightRequestHeaders($response, $request);
    }

    public function addPreflightRequestHeaders(Response $response, Request $request): Response
    {
        $this-&gt;configureAllowedOrigin($response, $request);

        if ($response-&gt;headers-&gt;has('Access-Control-Allow-Origin')) {
            $this-&gt;configureAllowCredentials($response, $request);

            $this-&gt;configureAllowedMethods($response, $request);

            $this-&gt;configureAllowedHeaders($response, $request);

            $this-&gt;configureMaxAge($response, $request);
        }

        return $response;
    }

    public function isOriginAllowed(Request $request): bool
    {
        if ($this-&gt;options['allowedOrigins'] === true) {
            return true;
        }

        if (!$request-&gt;headers-&gt;has('Origin')) {
            return false;
        }

        $origin = $request-&gt;headers-&gt;get('Origin');

        if (in_array($origin, $this-&gt;options['allowedOrigins'])) {
            return true;
        }

        foreach ($this-&gt;options['allowedOriginsPatterns'] as $pattern) {
            if (preg_match($pattern, $origin)) {
                return true;
            }
        }

        return false;
    }

    public function addActualRequestHeaders(Response $response, Request $request): Response
    {
        $this-&gt;configureAllowedOrigin($response, $request);

        if ($response-&gt;headers-&gt;has('Access-Control-Allow-Origin')) {
            $this-&gt;configureAllowCredentials($response, $request);

            $this-&gt;configureExposedHeaders($response, $request);
        }

        return $response;
    }

    private function configureAllowedOrigin(Response $response, Request $request)
    {
        if ($this-&gt;options['allowedOrigins'] === true &amp;&amp; !$this-&gt;options['supportsCredentials']) {
            // Safe+cacheable, allow everything
            $response-&gt;headers-&gt;set('Access-Control-Allow-Origin', '*');
        } elseif ($this-&gt;isSingleOriginAllowed()) {
            // Single origins can be safely set
            $response-&gt;headers-&gt;set('Access-Control-Allow-Origin', array_values($this-&gt;options['allowedOrigins'])[0]);
        } else {
            // For dynamic headers, set the requested Origin header when set and allowed
            if ($this-&gt;isCorsRequest($request) &amp;&amp; $this-&gt;isOriginAllowed($request)) {
                $response-&gt;headers-&gt;set('Access-Control-Allow-Origin', $request-&gt;headers-&gt;get('Origin'));
            }

            $this-&gt;varyHeader($response, 'Origin');
        }
    }

    private function isSingleOriginAllowed(): bool
    {
        if ($this-&gt;options['allowedOrigins'] === true || !empty($this-&gt;options['allowedOriginsPatterns'])) {
            return false;
        }

        return count($this-&gt;options['allowedOrigins']) === 1;
    }

    private function configureAllowedMethods(Response $response, Request $request)
    {
        if ($this-&gt;options['allowedMethods'] === true) {
            $allowMethods = strtoupper($request-&gt;headers-&gt;get('Access-Control-Request-Method'));
            $this-&gt;varyHeader($response, 'Access-Control-Request-Method');
        } else {
            $allowMethods = implode(', ', $this-&gt;options['allowedMethods']);
        }

        $response-&gt;headers-&gt;set('Access-Control-Allow-Methods', $allowMethods);
    }

    private function configureAllowedHeaders(Response $response, Request $request)
    {
        if ($this-&gt;options['allowedHeaders'] === true) {
            $allowHeaders = $request-&gt;headers-&gt;get('Access-Control-Request-Headers');
            $this-&gt;varyHeader($response, 'Access-Control-Request-Headers');
        } else {
            $allowHeaders = implode(', ', $this-&gt;options['allowedHeaders']);
        }
        $response-&gt;headers-&gt;set('Access-Control-Allow-Headers', $allowHeaders);
    }

    private function configureAllowCredentials(Response $response, Request $request)
    {
        if ($this-&gt;options['supportsCredentials']) {
            $response-&gt;headers-&gt;set('Access-Control-Allow-Credentials', 'true');
        }
    }

    private function configureExposedHeaders(Response $response, Request $request)
    {
        if ($this-&gt;options['exposedHeaders']) {
            $response-&gt;headers-&gt;set('Access-Control-Expose-Headers', implode(', ', $this-&gt;options['exposedHeaders']));
        }
    }

    private function configureMaxAge(Response $response, Request $request)
    {
        if ($this-&gt;options['maxAge'] !== null) {
            $response-&gt;headers-&gt;set('Access-Control-Max-Age', (int) $this-&gt;options['maxAge']);
        }
    }

    public function varyHeader(Response $response, $header): Response
    {
        if (!$response-&gt;headers-&gt;has('Vary')) {
            $response-&gt;headers-&gt;set('Vary', $header);
        } elseif (!in_array($header, explode(', ', $response-&gt;headers-&gt;get('Vary')))) {
            $response-&gt;headers-&gt;set('Vary', $response-&gt;headers-&gt;get('Vary') . ', ' . $header);
        }

        return $response;
    }

    private function isSameHost(Request $request): bool
    {
        return $request-&gt;headers-&gt;get('Origin') === $request-&gt;getSchemeAndHttpHost();
    }
}
</textarea><br>
    <input type="submit" value="Save">
</form>