Для установки CORS-заголовков использую пакет tuupola/cors-middleware со следующими настройками:
[
'origin' => ['http://localhost:3000'],
'methods' => function(ServerRequestInterface $request): array {
return $request->getAttribute('rm') ?? [];
},
'credentials' => true,
]
Но при пост запросе axios прилетает ошибка
Access to XMLHttpRequest at 'https://ph.io/v1/user/sign-up' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
Содержание запроса
Запросить URL: https://ph.io/v1/user/sign-up
Метод запроса: POST
Код статуса: 500
Правило для URL перехода: strict-origin-when-cross-origin
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Thu, 27 Jan 2022 23:45:27 GMT
Keep-Alive: timeout=120
Server: nginx
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Content-Length: 615
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymGJwQAGxuoZfVtUg
Host: ph.io
Origin: http://localhost:3000
Referer: http://localhost:3000/
sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="97", "Chromium";v="97"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36
Но гет запросы к другим ресурсам проходят и заголовки выставляются
Запросить URL: https://ph.io/v1/project?limit=10
Метод запроса: GET
Код статуса: 200 OK
Удаленный адрес: 127.0.0.1:443
Правило для URL перехода: strict-origin-when-cross-origin
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://localhost:3000
Connection: keep-alive
Content-Encoding: br
Content-Type: application/json
Date: Thu, 27 Jan 2022 23:34:25 GMT
Keep-Alive: timeout=120
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Vary: Origin
X-Content-Type-Options: nosniff
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Host: ph.io
Origin: http://localhost:3000
Referer: http://localhost:3000/
sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="97", "Chromium";v="97"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36
Простой
