[9.x] Integrate Laravel CORS into framework

composer.json

@@ -24,6 +24,7 @@
         "laravel/serializable-closure": "^1.0",
         "league/commonmark": "^2.2",
         "league/flysystem": "^3.0",
+        "fruitcake/php-cors": "^1.2",
         "monolog/monolog": "^2.0",
         "nesbot/carbon": "^2.53.1",
         "psr/container": "^1.1.1|^2.0.1",

src/Illuminate/Http/Middleware/HandleCors.php

@@ -0,0 +1,140 @@
+<?php
+
+namespace Illuminate\Http\Middleware;
+
+use Closure;
+use Fruitcake\Cors\CorsService;
+use Illuminate\Contracts\Container\Container;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class HandleCors
+{
+    /**
+     * The container instance.
+     *
+     * @var \Illuminate\Contracts\Container\Container
+     */
+    protected $container;
+
+    /**
+     * The CORS service instance.
+     *
+     * @var \Fruitcake\Cors\CorsService
+     */
+    protected $cors;
+
+    /**
+     * Create a new middleware instance.
+     *
+     * @param  \Illuminate\Contracts\Container\Container  $container
+     * @param  \Fruitcake\Cors\CorsService  $cors
+     * @return void
+     */
+    public function __construct(Container $container, CorsService $cors)
+    {
+        $this->container = $container;
+        $this->cors = $cors;
+    }
+
+    /**
+     * Handle the incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return \Illuminate\Http\Response
+     */
+    public function handle($request, Closure $next)
+    {
+        if (! $this->shouldRun($request)) {
+            return $next($request);
+        }
+
+        $this->cors->setOptions($this->container['config']->get('cors', []));
+
+        if ($this->cors->isPreflightRequest($request)) {
+            $response = $this->cors->handlePreflightRequest($request);
+
+            $this->cors->varyHeader($response, 'Access-Control-Request-Method');
+
+            return $response;
+        }
+
+        $response = $next($request);
+
+        if ($request->getMethod() === 'OPTIONS') {
+            $this->cors->varyHeader($response, 'Access-Control-Request-Method');
+        }
+
+        return $this->addHeaders($request, $response);
+    }
+
+    /**
+     * Add the headers to the response, if they don't exist yet.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Illuminate\Http\Response  $response
+     * @return \Illuminate\Http\Response
+     */
+    protected function addHeaders(Request $request, Response $response)
+    {
+        if (! $response->headers->has('Access-Control-Allow-Origin')) {
+            $response = $this->cors->addActualRequestHeaders($response, $request);
+        }
+
+        return $response;
+    }
+
+    /**
+     * Determine if the request has a URI that should pass through the CORS flow.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return bool
+     */
+    protected function shouldRun(Request $request): bool
+    {
+        return $this->isMatchingPath($request);
+    }
+
+    /**
+     * The the path from the config, to see if the CORS Service should run.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return bool
+     */
+    protected function isMatchingPath(Request $request): bool
+    {
+        $paths = $this->getPathsByHost($request->getHost());
+
+        foreach ($paths as $path) {
+            if ($path !== '/') {
+                $path = trim($path, '/');
+            }
+
+            if ($request->fullUrlIs($path) || $request->is($path)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Paths by given host or string values in config by default.
+     *
+     * @param  string  $host
+     * @return array
+     */
+    protected function getPathsByHost(string $host)
+    {
+        $paths = $this->container['config']->get('cors.paths', []);
+
+        if (isset($paths[$host])) {
+            return $paths[$host];
+        }
+
+        return array_filter($paths, function ($path) {
+            return is_string($path);
+        });
+    }
+}

src/Illuminate/Http/Middleware/TrustHosts.php

@@ -2,6 +2,7 @@
 
 namespace Illuminate\Http\Middleware;
 
+use Closure;
 use Illuminate\Contracts\Foundation\Application;
 use Illuminate\Http\Request;
 
@@ -36,10 +37,10 @@ abstract public function hosts();
      * Handle the incoming request.
      *
      * @param  \Illuminate\Http\Request  $request
-     * @param  callable  $next
+     * @param  \Closure  $next
      * @return \Illuminate\Http\Response
      */
-    public function handle(Request $request, $next)
+    public function handle(Request $request, Closure $next)
     {
         if ($this->shouldSpecifyTrustedHosts()) {
             Request::setTrustedHosts(array_filter($this->hosts()));

src/Illuminate/Http/composer.json

@@ -16,6 +16,7 @@
     "require": {
         "php": "^8.0.2",
         "ext-json": "*",
+        "fruitcake/php-cors": "^1.2",
         "illuminate/collections": "^9.0",
         "illuminate/macroable": "^9.0",
         "illuminate/session": "^9.0",