public function addCorsHeaders(HTTPRequest $request, HTTPResponse $response)
    {
        $corsConfig = Config::inst()->get(static::class, 'cors');

        // If CORS is disabled don't add the extra headers. Simply return the response untouched.
        if (empty($corsConfig['Enabled'])) {
            return $response;
        }

        // Calculate origin
        $origin = $this->getRequestOrigin($request);

        // Check if valid
        $allowedOrigins = (array)$corsConfig['Allow-Origin'];
        $originAuthorised = $this->validateOrigin($origin, $allowedOrigins);
        if (!$originAuthorised) {
            $this->httpError(403, "Access Forbidden");
        }

        $response->addHeader('Access-Control-Allow-Origin', $origin);
        $response->addHeader('Access-Control-Allow-Headers', $corsConfig['Allow-Headers']);
        $response->addHeader('Access-Control-Allow-Methods', $corsConfig['Allow-Methods']);
        $response->addHeader('Access-Control-Max-Age', $corsConfig['Max-Age']);

        if (isset($corsConfig['Allow-Credentials'])) {
            $response->addHeader('Access-Control-Allow-Credentials', $corsConfig['Allow-Credentials']);
        }

        return $response;
    }
public function addCorsHeaders(HTTPRequest $request, HTTPResponse $response)
    {
        $corsConfig = Config::inst()->get(static::class, 'cors');

        // If CORS is disabled don't add the extra headers. Simply return the response untouched.
        if (empty($corsConfig['Enabled'])) {
            return $response;
        }

        // Calculate origin
        $origin = $this->getRequestOrigin($request);

        // Check if valid
        $allowedOrigins = (array)$corsConfig['Allow-Origin'];
        $originAuthorised = $this->validateOrigin($origin, $allowedOrigins);
        if (!$originAuthorised) {
            $this->httpError(403, "Access Forbidden");
        }

        $response->addHeader('Access-Control-Allow-Origin', $origin);
        $response->addHeader('Access-Control-Allow-Headers', $corsConfig['Allow-Headers']);
        $response->addHeader('Access-Control-Allow-Methods', $corsConfig['Allow-Methods']);
        $response->addHeader('Access-Control-Max-Age', $corsConfig['Max-Age']);

        if (isset($corsConfig['Allow-Credentials'])) {
            $response->addHeader('Access-Control-Allow-Credentials', $corsConfig['Allow-Credentials']);
        }

        return $response;
    }
public function addCorsHeaders ( HTTPRequest $ request , HTTPResponse $ response ) { $ corsConfig = Config :: inst ( ) -> get ( static :: class , 'cors' ) ; // If CORS is disabled don't add the extra headers. Simply return the response untouched. if ( empty ( $ corsConfig [ 'Enabled' ] ) ) { return $ response ; } // Calculate origin $ origin = $ this -> getRequestOrigin ( $ request ) ; // Check if valid $ allowedOrigins = ( array ) $ corsConfig [ 'Allow-Origin' ] ; $ originAuthorised = $ this -> validateOrigin ( $ origin , $ allowedOrigins ) ; if ( ! $ originAuthorised ) { $ this -> httpError ( 403 , "Access Forbidden" ) ; } $ response -> addHeader ( 'Access-Control-Allow-Origin' , $ origin ) ; $ response -> addHeader ( 'Access-Control-Allow-Headers' , $ corsConfig [ 'Allow-Headers' ] ) ; $ response -> addHeader ( 'Access-Control-Allow-Methods' , $ corsConfig [ 'Allow-Methods' ] ) ; $ response -> addHeader ( 'Access-Control-Max-Age' , $ corsConfig [ 'Max-Age' ] ) ; if ( isset ( $ corsConfig [ 'Allow-Credentials' ] ) ) { $ response -> addHeader ( 'Access-Control-Allow-Credentials' , $ corsConfig [ 'Allow-Credentials' ] ) ; } return $ response ; }
Process the CORS config options and add the appropriate headers to the response.

@param HTTPRequest $request
@param HTTPResponse $response
@return HTTPResponse
Process the CORS config options and add the appropriate headers to the response .