PR fixes

bpolaszek · Oct 14, 2024 · 88585d8 · 88585d8
1 parent 88380cc
commit 88585d8
Showing 1 changed file with 15 additions and 12 deletions.
diff --git a/src/Hub/Middleware/CorsMiddleware.php b/src/Hub/Middleware/CorsMiddleware.php
@@ -6,27 +6,30 @@
 use Psr\Http\Message\ServerRequestInterface;
 use React\Http\Message\Response;
 
-class CorsMiddleware
+final class CorsMiddleware
 {
     public function __construct(
-        private ?string $corsOrigin
-    )
-    {
-        if (!$this->corsOrigin) {
-            $this->corsOrigin = 'null';
-        }
+        private readonly ?string $corsOrigin = '*',
+    ) {
     }
 
     public function __invoke(
         ServerRequestInterface $request,
-        callable               $next
-    ): ResponseInterface
-    {
+        callable $next
+    ): ResponseInterface {
         $response = $next($request);
 
-        return $response->withAddedHeader('Access-Control-Allow-Origin', $this->corsOrigin)
+        $corsOrigin = $this->corsOrigin ?? $this->getOrigin($request);
+
+        return $response->withAddedHeader('Access-Control-Allow-Origin', $corsOrigin)
             ->withAddedHeader('Access-Control-Allow-Headers', '*')
             ->withAddedHeader('Access-Control-Allow-Methods', '*')
+            ->withAddedHeader('Access-Control-Allow-Credentials', 'true')
             ->withStatus(Response::STATUS_OK);
     }
-}
+
+    private function getOrigin(ServerRequestInterface $request): string
+    {
+        return $request->getHeaderLine('Origin') ?: 'null';
+    }
+}