How to add CORS

[diegohdez90]

Version: 3.4.5

Issue: I add Twilio in composer.json.
PHP Version: 7.2.X (I Know that is obsolte, in my job is still using obsolete xampp).

In the URL in production https://clicksseeker.com/register/agency I create an user to receive 6 digits to valid my email registration; but, I receive an error from CORS .

Request URL: https://api.clicksseeker.com/auth/register
Referrer Policy: strict-origin-when-cross-origin

My doubt is how to add CORS headers in phalcon; whatever, code on index.php or adding a specific .htaccess.

Thanks.

Images for reference, I create a ticket in Twilio and finally receive an answer where the problem is from CORS
https://support.twilio.com/attachments/token/jTWMC2GIWsnv3H5f8iu6yMDp4/?name=Screenshot+2021-02-04+102717.png
https://support.twilio.com/attachments/token/8cER1HuVGwFK7ns4Psri6HRxS/?name=Screenshot+2021-02-04+102904.png
https://support.twilio.com/attachments/token/1KlmmKWforItsymczppICVLIh/?name=Screenshot+2021-02-04+102923.png

[renatogabrielbr]

You mean it?

I did a test on your website, suppose that you use phalcon on the api, just put it in response.

$this->response->setHeader('Access-Control-Allow-Origin', '*');
https://docs.phalcon.io/4.0/pt-br/response#headers

You can do with .htaccess, i think is your case.

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
</IfModule>

[diegohdez90]

Thanks @tidytrax for your response.

Also, there is a api.php file where it has all application api routes , and my project manager notice me that exists a CORS declaration in the file, and this is:

$app->options('/:controller/:params', function () {
    return [
        'message' => 'Fuck CORS'
    ];
});

In this block I have to set CORS headers.

I hope your advice.

Thanks a lot.

[renatogabrielbr]

I use a listener for it in some project's

class PreFlight extends \Phalcon\Di\Injectable
{
    public function beforeDispatchLoop()
    {
        if ($this->request->isOptions()) {
            $this->response->setContentType('application/json', 'UTF-8');
            $this->response->setHeader('Access-Control-Allow-Origin', $this->request->getHeader('origin'));
            $this->response->setHeader("Access-Control-Allow-Headers", "authorization");
            $this->response->setHeader("Access-Control-Allow-Methods", 'GET,POST,DELETE,PUT');
            $this->response->setHeader('Access-Control-Allow-Credentials', 'true');
            $this->response->send();
            exit();
        }
    }
}

On services

$di->setShared('dispatcher', function () {
    $eventsManager = new EventsManager();
    $eventsManager->enablePriorities(true);
    $eventsManager->attach("dispatch", new PreFlight(), 260);
    $dispatcher = new Dispatcher();
    $dispatcher->setEventsManager($eventsManager);
    return $dispatcher;
});

[renatogabrielbr]

You can use beforeMatch on route.

$route->beforeMatch(
    function ($uri, $route) { }
);

https://docs.phalcon.io/4.0/en/routing#callbacks

[diegohdez90]

@tidytrax I added both codes in services.php file and occurs the same error. In which directory I had to create PreFlight.php file.

class PreFlight extends \Phalcon\Di\Injectable
{
    public function beforeDispatchLoop()
    {
        if ($this->request->isOptions()) {
            $this->response->setContentType('application/json', 'UTF-8');
            $this->response->setHeader('Access-Control-Allow-Origin', $this->request->getHeader('origin'));
            $this->response->setHeader("Access-Control-Allow-Headers", "authorization");
            $this->response->setHeader("Access-Control-Allow-Methods", 'GET,POST,DELETE,PUT');
            $this->response->setHeader('Access-Control-Allow-Credentials', 'true');
            $this->response->send();
            exit();
        }
    }
}

...
$di->setShared('dispatcher', function () {
    $eventsManager = new EventsManager();
    $eventsManager->enablePriorities(true);
    $eventsManager->attach("dispatch", new PreFlight(), 260);
    $dispatcher = new Dispatcher();
    $dispatcher->setEventsManager($eventsManager);
    return $dispatcher;
});

[renatogabrielbr]

No need to be in a directory. should be working.
The pre flight must be in api project.

you can test change this line

$this->response->setHeader('Access-Control-Allow-Origin', $this->request->getHeader('origin'));

To accept any origin

$this->response->setHeader('Access-Control-Allow-Origin', '*');

And can you test on local environment?
and if you can post the response and request headers.

[DrJLT]

What I recommend is to add this to nginx's server block:

add_header 'access-control-allow-origin' 'https://clicksseeker.com';

[diegohdez90]

@tidytrax @DrJLT

I use this: #15310 (comment) into services.php
and this https://forum.phalcon.io/discussion/17171/phalcon-micro-rest-api-cors-header-accesscontrolalloworigin-miss into api.php

and no works in https://panel.clicksseeker.com

Finally I saw that works in nginx, so would you like to see the nginx file?. This file is localted in /etc/nginx/sites-available/ directory with the name default.