Fruitcake PHP CORS

https://github.com/fruitcake/php-cors
Admin
Fruitcake PHP CORS is a library and middleware enabling cross-origin resource sharing for Symfony...
Tokens:14,756
Snippets:98
Trust Score:8.1
License:MIT
Update:1 month ago
Show doc for...
Tokens:
Raw
### Usage example for isPreflightRequest

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Example usage of isPreflightRequest to detect a preflight request and handle it.

```php
if ($cors->isPreflightRequest($request)) {
    return $cors->handlePreflightRequest($request);
}
```

--------------------------------

### Using the CorsService library

Source: https://github.com/fruitcake/php-cors/blob/master/README.md

Example of creating a CorsService instance with configuration options and calling its methods to handle CORS requests. The options include allowedHeaders, allowedMethods, allowedOrigins, allowedOriginsPatterns, exposedHeaders, maxAge, and supportsCredentials. The example shows how to add actual request headers, handle preflight requests, and check if requests are allowed.

```php
<?php

use Fruitcake\Cors\CorsService;

$cors = new CorsService([
    'allowedHeaders'         => ['x-allowed-header', 'x-other-allowed-header'],
    'allowedMethods'         => ['DELETE', 'GET', 'POST', 'PUT'],
    'allowedOrigins'         => ['http://localhost', 'https://*.example.com'],
    'allowedOriginsPatterns' => ['/localhost:\d/'],
    'exposedHeaders'         => ['Content-Encoding'],
    'maxAge'                 => 0,
    'supportsCredentials'    => false,
]);

$cors->addActualRequestHeaders(Response $response, $origin);
$cors->handlePreflightRequest(Request $request);
$cors->isActualRequestAllowed(Request $request);
$cors->isCorsRequest(Request $request);
$cors->isPreflightRequest(Request $request);
```

--------------------------------

### Typical integration for handlePreflightRequest

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Example of typical integration: answering a preflight request directly by returning the response from handlePreflightRequest.

```php
// Typical integration: answer the preflight directly
if ($cors->isPreflightRequest($request)) {
    return $cors->handlePreflightRequest($request);
}
```

--------------------------------

### Usage example with try-catch

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/InvalidOptionException.md

Demonstrates using CorsService with a try-catch that handles both \TypeError and InvalidOptionException. The example sets options and handles a preflight request, rethrowing a \RuntimeException on configuration error.

```php
use Fruitcake\Cors\CorsService;
use Fruitcake\Cors\Exceptions\InvalidOptionException;
use Symfony\Component\HttpFoundation\Request;

$cors = new CorsService();

try {
    $cors->setOptions(['allowedOrigins' => ['https://app.example.com']]);
    $response = $cors->handlePreflightRequest(new Request());
} catch (\TypeError | InvalidOptionException $e) {
    // handle configuration error
    throw new \RuntimeException('CORS configuration failed', 0, $e);
}
```

--------------------------------

### Usage example for isCorsRequest

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Example usage of isCorsRequest to check if a request has an Origin header.

```php
if ($cors->isCorsRequest($request)) {
    // request has an Origin header
}
```

--------------------------------

### isOriginAllowed() usage example

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Shows how to check if a request's origin is allowed using isOriginAllowed(). The method returns a boolean; the example branches on the result to proceed with cross-origin logic or reject with a 403 status.

```php
if ($cors->isOriginAllowed($request)) {
    // proceed with cross-origin logic
} else {
    // optionally reject with 403 before adding headers
}
```

--------------------------------

### varyHeader usage example

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Shows how to call varyHeader with different headers. The first call sets Vary: Origin, the second appends Accept-Language, and the third is a no-op because Origin is already present.

```php
$response = new Response();
$cors->varyHeader($response, 'Origin');           // Vary: Origin
$cors->varyHeader($response, 'Accept-Language');  // Vary: Origin, Accept-Language
$cors->varyHeader($response, 'Origin');           // unchanged (already present)
```

--------------------------------

### CorsService configuration examples

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/configuration.md

Shows five ways to configure CorsService: a static single origin (most cacheable), wildcard with credentials (dynamic, echoes origin, adds Vary: Origin), PCRE pattern matching over the Origin header, wildcard origins converted to patterns automatically, and a full non-cacheable configuration with all options.

```php
// Static single origin — most cacheable
new CorsService(['allowedOrigins' => ['https://app.example.com']]);
```

```php
// Wildcard + credentials — dynamic, echoes origin, adds Vary: Origin
new CorsService(['allowedOrigins' => ['*'], 'supportsCredentials' => true]);
```

```php
// Pattern matching (PCRE over the Origin header)
new CorsService(['allowedOriginsPatterns' => ['/^https:\/\/[a-z]+\.example\.com$/']]);
```

```php
// Wildcard origins converted to patterns automatically
new CorsService(['allowedOrigins' => ['https://*.example.com']]);
```

```php
// Full non-cacheable config
new CorsService([
    'allowedOrigins'         => ['https://a.example.com', 'https://b.example.com'],
    'allowedOriginsPatterns' => ['/localhost:\d{4}/'],
    'allowedMethods'         => ['DELETE', 'GET', 'POST', 'PUT'],
    'allowedHeaders'         => ['X-Allowed-Header', 'X-Other-Allowed-Header'],
    'exposedHeaders'         => ['Content-Encoding'],
    'maxAge'                 => 0,
    'supportsCredentials'    => false,
]);
```

--------------------------------

### addPreflightRequestHeaders() usage example

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Shows how to call addPreflightRequestHeaders() with a new Response and a preflight request. The method mutates the response in place, adding Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Max-Age headers when the origin is accepted.

```php
$response = new Response();
$cors->addPreflightRequestHeaders($response, $request);
// $response->headers->get('Access-Control-Allow-Origin')    → 'https://app.example.com'
// $response->headers->get('Access-Control-Allow-Methods')   → 'GET, POST'
// $response->headers->get('Access-Control-Allow-Headers')   → 'content-type, x-requested-with'
// $response->headers->get('Access-Control-Max-Age')         → '86400'
```

--------------------------------

### Replace CORS configuration at runtime with setOptions()

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Shows how to instantiate CorsService with initial options and then replace the entire configuration at runtime. Demonstrates snake_case keys, uppercasing of methods, and enabling credentials.

```php
$cors = new CorsService(['allowedOrigins' => ['https://old.example.com']]);

// Replace the entire configuration at runtime
$cors->setOptions([
    'allowed_origins'      => ['https://new.example.com'], // snake_case also works
    'allowed_methods'      => ['get', 'post'],             // will be uppercased
    'supports_credentials' => true,
]);
```

--------------------------------

### Constructor with default and custom options

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Shows two ways to instantiate CorsService: with no options (defaults) and with a custom options array including allowed origins and credentials support.

```php
$cors = new CorsService(); // defaults only
$cors = new CorsService([
    'allowedOrigins'      => ['https://api.example.com'],
    'supportsCredentials' => true,
]);
```

--------------------------------

### Instantiate CorsService and handle CORS requests

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Shows how to create a CorsService with allowed origins, methods, headers, and max age, then use it to handle preflight requests and add actual request headers to a Symfony Response.

```php
use Fruitcake\Cors\CorsService;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;

$cors = new CorsService([
    'allowedOrigins' => ['https://app.example.com'],
    'allowedMethods' => ['GET', 'POST', 'PUT', 'DELETE'],
    'allowedHeaders' => ['Content-Type', 'X-Requested-With'],
    'maxAge'         => 86400,
]);

if ($cors->isPreflightRequest($request)) {
    return $cors->handlePreflightRequest($request);
}

$response = new Response('Hello');
return $cors->addActualRequestHeaders($response, $request);
```

--------------------------------

### MockApp usage loop for framework integration

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Canonical usage loop from tests/MockApp.php used by framework integrations. Handles preflight requests and adds actual request headers, varying on Access-Control-Request-Method as needed.

```php
if ($cors->isPreflightRequest($request)) {
    $response = $cors->handlePreflightRequest($request);
    return $cors->varyHeader($response, 'Access-Control-Request-Method');
}
$response = new Response();
if ($request->getMethod() === 'OPTIONS') {
    $cors->varyHeader($response, 'Access-Control-Request-Method');
}
return $cors->addActualRequestHeaders($response, $request);
```

--------------------------------

### __construct(array $options = [])

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Constructor for the CorsService class. Accepts an optional options array to configure CORS behavior. When options are provided, they are delegated to setOptions().

```APIDOC
## `__construct(array $options = [])`

### Description
Constructor for the CORS service. Accepts an optional options array to configure allowed origins, methods, headers, credentials, and max age. When options are provided, they are delegated to `setOptions()`.

### Method
Constructor

### Signature
`public function __construct(array $options = [])`

### Parameters
- **$options** (array) - Optional - Default: `[]` - Constructor options; see configuration.md. When non-empty, delegates to `setOptions()`. If empty, keeps property defaults (`[]` for all header lists, `false` for credentials, `0` for `maxAge`).

### Throws
- `\TypeError` when a value of the wrong type is passed for a typed option (e.g. `'allowedOrigins' => 'string'`).

### Example
```php
$cors = new CorsService(); // defaults only
$cors = new CorsService([
    'allowedOrigins'      => ['https://api.example.com'],
    'supportsCredentials' => true,
]);
```
```

--------------------------------

### addPreflightRequestHeaders(Response $response, Request $request): Response

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Applies preflight headers to an existing response. Runs configureAllowedOrigin() first and only sets remaining headers if the origin is accepted.

```APIDOC
## addPreflightRequestHeaders(Response $response, Request $request): Response

### Description
Applies preflight headers to an existing response. Unlike handlePreflightRequest(), it does not create a response or set a status code. Runs configureAllowedOrigin() first; the remaining headers (Access-Control-Allow-Credentials, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Max-Age) are only configured if Access-Control-Allow-Origin ended up on the response.

### Method
N/A (PHP method)

### Endpoint
N/A

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
```php
$response = new Response();
$cors->addPreflightRequestHeaders($response, $request);
```

### Response
#### Success Response (200)
Returns the same Response instance, mutated with headers.

#### Response Example
```php
// $response->headers->get('Access-Control-Allow-Origin')    → 'https://app.example.com'
// $response->headers->get('Access-Control-Allow-Methods')   → 'GET, POST'
// $response->headers->get('Access-Control-Allow-Headers')   → 'content-type, x-requested-with'
// $response->headers->get('Access-Control-Max-Age')         → '86400'
```
```

--------------------------------

### handlePreflightRequest method signature

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Signature for the handlePreflightRequest method. Takes a preflight Request and returns a Response with 204 status and preflight headers.

```php
public function handlePreflightRequest(Request $request): Response
```

--------------------------------

### handlePreflightRequest(Request $request): Response

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Handles a CORS preflight request by creating a new 204 No Content response with the appropriate Access-Control-* headers.

```APIDOC
## `handlePreflightRequest(Request $request): Response`

### Description
Creates a new `Response`, sets its status code to `204 No Content`, then applies preflight headers via `addPreflightRequestHeaders()` and returns it.

### Method
PHP Method

### Endpoint
`CorsService::handlePreflightRequest`

### Parameters
#### Path Parameters
- **$request** (`Symfony\Component\HttpFoundation\Request`) - Required - The preflight request.

### Request Example
```php
// Typical integration: answer the preflight directly
if ($cors->isPreflightRequest($request)) {
    return $cors->handlePreflightRequest($request);
}
```

### Response
#### Success Response (Response)
- **Response** - A fresh 204 response carrying the `Access-Control-*` headers.

#### Response Example
```php
// Response object with status 204 and headers
```
```

--------------------------------

### isOriginAllowed(Request $request): bool

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Tests only the origin, independent of method or preflight state. Returns true if the origin is allowed by configuration.

```APIDOC
## isOriginAllowed(Request $request): bool

### Description
Tests only the origin, independent of method or preflight state. Returns true if allowAllOrigins is set, the Origin header exactly matches a string in allowedOrigins, or matches any PCRE in allowedOriginsPatterns.

### Method
N/A (PHP method)

### Endpoint
N/A

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
```php
if ($cors->isOriginAllowed($request)) {
    // proceed with cross-origin logic
} else {
    // optionally reject with 403 before adding headers
}
```

### Response
#### Success Response (200)
Returns bool indicating whether the request origin is permitted.

#### Response Example
```php
// true or false
```
```

--------------------------------

### setOptions(array $options): void

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Overwrites all configured CORS options at once. Accepts an array of options with camelCase or snake_case keys, normalizes them (lowercasing headers, uppercasing methods, handling wildcards), and throws a TypeError on invalid values.

```APIDOC
## setOptions(array $options): void

### Description
Overwrites all configured options at once. Per-option fallback order is `$options['camelCase'] ?? $options['snake_case'] ?? currentValue`, except `maxAge` which additionally honors explicit `null` (checked via `array_key_exists` so `null` is respected rather than falling through). `exposedHeaders => false` is normalized to `[]`. Afterwards `normalizeOptions()` runs: headers are lowercased (`array_map('strtolower', ...)`), methods uppercased, `'*'` entries set the `allowAll*` flags, and origins containing `'*'` are converted to patterns via `convertWildcardToPattern()`.

### Method
setOptions

### Endpoint
setOptions(array $options): void

### Parameters
#### Path Parameters
- None

#### Query Parameters
- None

#### Request Body
- **$options** (array) - Required - Options to apply; overwrites the previously configured values and re-normalizes. Both camelCase and snake_case keys are accepted.

### Request Example
```php
$cors = new CorsService(['allowedOrigins' => ['https://old.example.com']]);

// Replace the entire configuration at runtime
$cors->setOptions([
    'allowed_origins'      => ['https://new.example.com'], // snake_case also works
    'allowed_methods'      => ['get', 'post'],             // will be uppercased
    'supports_credentials' => true,
]);
```

### Response
#### Success Response (void)
- No return value.

#### Response Example
No response body.

### Error Handling
Throws: `\TypeError` on wrong-typed option values (see [errors.md](../errors.md)).
```

--------------------------------

### isPreflightRequest(Request $request): bool

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Determines whether the given request is a CORS preflight request by checking for the OPTIONS method and the Access-Control-Request-Method header.

```APIDOC
## `isPreflightRequest(Request $request): bool`

### Description
Returns `true` when the request method is `OPTIONS` and the request carries an `Access-Control-Request-Method` header, which is the W3C signal for a preflight.

### Method
PHP Method

### Endpoint
`CorsService::isPreflightRequest`

### Parameters
#### Path Parameters
- **$request** (`Symfony\Component\HttpFoundation\Request`) - Required - The incoming request.

### Request Example
```php
if ($cors->isPreflightRequest($request)) {
    return $cors->handlePreflightRequest($request);
}
```

### Response
#### Success Response (bool)
- **bool** - `true` if the request is a CORS preflight.

#### Response Example
```php
true
```
```

--------------------------------

### addActualRequestHeaders(Response $response, Request $request): Response

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Applies CORS headers to a normal (non-preflight) response. It configures the Access-Control-Allow-Origin header based on the request origin and allowed origins, and optionally adds Access-Control-Allow-Credentials and Access-Control-Expose-Headers headers.

```APIDOC
## addActualRequestHeaders(Response $response, Request $request): Response

### Description
Applies headers for a normal (non-preflight) request. Runs `configureAllowedOrigin()`; if `Access-Control-Allow-Origin` was set it additionally configures `Access-Control-Allow-Credentials` (when `supportsCredentials`) and `Access-Control-Expose-Headers` (when `exposedHeaders` is non-empty), then returns the response.

### Method
PHP method

### Signature
```php
public function addActualRequestHeaders(Response $response, Request $request): Response
```

### Parameters
- **$response** (Symfony\Component\HttpFoundation\Response) - Required - The response to the actual (non-preflight) request.
- **$request** (Symfony\Component\HttpFoundation\Request) - Required - The actual request.

### Return Value
- **Response** - The same instance, mutated. If the origin is not allowed, no `Access-Control-*` headers are set (a `Vary` header may still be added in the dynamic branch).

### Behavior Details

Header decision for `Access-Control-Allow-Origin` (`configureAllowedOrigin()`):

- `'*'` when `allowAllOrigins` and `supportsCredentials === false` (cacheable, no `Vary`);
- the single configured origin string when exactly one static origin is configured and no patterns exist (no `Vary`);
- otherwise the echoed request `Origin` header when the request is a CORS request and the origin is allowed; `Vary: Origin` is appended in this dynamic branch in all cases.

### Request Example
```php
$response = new Response(json_encode($payload), 200, ['Content-Type' => 'application/json']);
return $cors->addActualRequestHeaders($response, $request);
```

### Advanced Example
```php
// Advanced: inspect the decision for a disallowed origin
$cors = new CorsService(['allowedOrigins' => ['http://notlocalhost']]);
$response = new Response();
$cors->addActualRequestHeaders($response, $request);

if (!$response->headers->has('Access-Control-Allow-Origin')) {
    // origin was rejected — the browser will block the response
    // response header 'Vary: Origin' may still be present
}
```
```

--------------------------------

### Class definition for InvalidOptionException

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/InvalidOptionException.md

Defines the InvalidOptionException class extending \RuntimeException. It declares no constants or methods, inheriting all from \RuntimeException and \Exception.

```php
namespace Fruitcake\Cors\Exceptions;

class InvalidOptionException extends \RuntimeException
{
}
```

--------------------------------

### Basic usage of addActualRequestHeaders

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Creates a JSON response and passes it to addActualRequestHeaders to apply CORS headers for a normal request. The method mutates and returns the same response instance.

```php
$response = new Response(json_encode($payload), 200, ['Content-Type' => 'application/json']);
return $cors->addActualRequestHeaders($response, $request);
```

--------------------------------

### varyHeader(Response $response, string $header): Response

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Appends a header name to the response's Vary header without duplicating it. If no Vary header exists it is set to the given header; if a single existing Vary value is present the value is appended as a comma-separated string; if multiple Vary values exist, Response::setVary($header, false) appends a new value. Returns the response.

```APIDOC
## varyHeader(Response $response, string $header): Response

### Description
Appends a header name to the response's `Vary` header without duplicating it. If no `Vary` header exists it is set to `$header`; if a single existing `Vary` value is present the value is appended as a comma-separated string; if multiple `Vary` values exist `Response::setVary($header, false)` appends a new value. Returns the response.

### Method
PHP method

### Endpoint
`CorsService::varyHeader(Response $response, string $header): Response`

### Parameters
#### Path Parameters
- **$response** (Symfony\Component\HttpFoundation\Response) - Required - Response to mutate.
- **$header** (string) - Required - Header name to add to the `Vary` list.

### Request Example
```php
$response = new Response();
$cors->varyHeader($response, 'Origin');           // Vary: Origin
$cors->varyHeader($response, 'Accept-Language');  // Vary: Origin, Accept-Language
$cors->varyHeader($response, 'Origin');           // unchanged (already present)
```

### Response
#### Success Response (200)
- **$response** (Symfony\Component\HttpFoundation\Response) - The same instance, mutated.

#### Response Example
```php
Response {#...}
```
```

--------------------------------

### varyHeader method signature

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Public method signature for varyHeader. Appends a header name to the Vary header without duplicating it. Returns the same Response instance.

```php
public function varyHeader(Response $response, string $header): Response
```

--------------------------------

### Advanced: inspect decision for disallowed origin

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Shows how to check whether the Access-Control-Allow-Origin header was set after calling addActualRequestHeaders. If the header is absent, the origin was rejected and the browser will block the response; a Vary: Origin header may still be present.

```php
// Advanced: inspect the decision for a disallowed origin
$cors = new CorsService(['allowedOrigins' => ['http://notlocalhost']]);
$response = new Response();
$cors->addActualRequestHeaders($response, $request);

if (!$response->headers->has('Access-Control-Allow-Origin')) {
    // origin was rejected — the browser will block the response
    // response header 'Vary: Origin' may still be present
}
```

--------------------------------

### Catching both \TypeError and InvalidOptionException

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/InvalidOptionException.md

Shows how to catch both failure modes: \TypeError for actual invalid option types and InvalidOptionException for integrations that throw it. Since \TypeError extends \Error, not \RuntimeException, a catch on \RuntimeException alone would miss it.

```php
try {
    $cors->setOptions($options);
} catch (\TypeError | InvalidOptionException $e) {
    // \TypeError: wrong-typed option (actual failure mode)
    // InvalidOptionException: only if an integration throws it
}
```

--------------------------------

### Catching InvalidOptionException in consumer code

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/InvalidOptionException.md

Shows how to catch InvalidOptionException when using CorsService. Note that the library never throws it; catching is only meaningful if a wrapper throws it. Invalid types raise \TypeError, which is not a \RuntimeException.

```php
use Fruitcake\Cors\CorsService;
use Fruitcake\Cors\Exceptions\InvalidOptionException;

try {
    $cors = new CorsService($options);
} catch (InvalidOptionException $e) {
    // Only reached if a wrapper throws it; invalid types raise \TypeError
    error_log($e->getMessage());
}
```

--------------------------------

### Catch TypeError and InvalidOptionException when using CorsService

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/errors.md

Use this snippet to handle errors when instantiating CorsService with invalid options. The first try-catch catches the actual \TypeError thrown for wrong option types. The second try-catch provides a defensive catch covering both the historical InvalidOptionException (never thrown, kept for BC) and \TypeError, wrapping them in a RuntimeException.

```php
use Fruitcake\Cors\CorsService;
use Fruitcake\Cors\Exceptions\InvalidOptionException;

try {
    $cors = new CorsService([
        'allowedOrigins' => 'https://example.com', // wrong type: string, not string[]
    ]);
} catch (\TypeError $e) {
    // Actual failure mode of this package
    error_log('CORS config type error: ' . $e->getMessage());
}

// Defensive catch covering both the historical and current APIs:
try {
    $cors = new CorsService($options);
    $cors->setOptions($moreOptions);
} catch (InvalidOptionException | \TypeError $e) {
    // InvalidOptionException: never thrown by this package, kept for BC
    // \TypeError: typo in option key/value types
    throw new \RuntimeException('Invalid CORS configuration', 0, $e);
}
```

--------------------------------

### isPreflightRequest method signature

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Signature for the isPreflightRequest method. Takes a Symfony Request and returns a boolean indicating if it is a preflight request (OPTIONS with Access-Control-Request-Method header).

```php
public function isPreflightRequest(Request $request): bool
```

--------------------------------

### isCorsRequest(Request $request): bool

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Determines whether the given request is a CORS request by checking for the presence of an Origin header.

```APIDOC
## `isCorsRequest(Request $request): bool`

### Description
Returns `true` when the request carries an `Origin` header, indicating a cross-origin request candidate regardless of HTTP method.

### Method
PHP Method

### Endpoint
`CorsService::isCorsRequest`

### Parameters
#### Path Parameters
- **$request** (`Symfony\Component\HttpFoundation\Request`) - Required - The incoming request.

### Request Example
```php
if ($cors->isCorsRequest($request)) {
    // request has an Origin header
}
```

### Response
#### Success Response (bool)
- **bool** - `true` if the request is a CORS request.

#### Response Example
```php
true
```
```

--------------------------------

### maxAge cast failure code block

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/errors.md

This code block shows the logic for handling the 'maxAge' option, including the fallback to 'max_age' and the cast to integer. It is from src/CorsService.php:80-87.

```php
$maxAge = $this->maxAge;
if (array_key_exists('maxAge', $options)) {
    $maxAge = $options['maxAge'];
} elseif (array_key_exists('max_age', $options)) {
    $maxAge = $options['max_age'];
}
$this->maxAge = $maxAge === null ? null : (int)$maxAge;
```

--------------------------------

### setOptions() method signature

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Declares the setOptions method that accepts an array of CORS options and returns void. The @param annotation indicates the expected type is CorsInputOptions.

```php
/**
 * @param CorsInputOptions $options
 */
public function setOptions(array $options): void
```

--------------------------------

### PHPStan type alias CorsNormalizedOptions (tests only)

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/types.md

Declared in tests/CorsServiceTest.php:14-25. Describes the private, normalized property state of CorsService after construction, read via reflection in getOptionsFromService(). Not part of the public API and not importable from the library.

```php
/**
 * @phpstan-type CorsNormalizedOptions array{
 *  'allowedOrigins': string[],
 *  'allowedOriginsPatterns': string[],
 *  'supportsCredentials': bool,
 *  'allowedHeaders': string[],
 *  'allowedMethods': string[],
 *  'exposedHeaders': string[],
 *  'maxAge': int|bool|null,
 *  'allowAllOrigins': bool,
 *  'allowAllHeaders': bool,
 *  'allowAllMethods': bool,
 * }
 */
```

--------------------------------

### isCorsRequest method signature

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/api-reference/CorsService.md

Signature for the isCorsRequest method. Takes a Symfony Request and returns a boolean indicating if the request has an Origin header.

```php
public function isCorsRequest(Request $request): bool
```

--------------------------------

### CorsInputOptions PHPStan type alias declaration

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/types.md

Declares the CorsInputOptions type alias in the CorsService docblock. All keys are optional, with camelCase and snake_case spellings. The camelCase key wins when both are present. The 'maxAge' union includes bool for backward compatibility; non-null values are cast to int.

```php
/**
 * @phpstan-type CorsInputOptions array{
 *  'allowedOrigins'?: string[],
 *  'allowedOriginsPatterns'?: string[],
 *  'supportsCredentials'?: bool,
 *  'allowedHeaders'?: string[],
 *  'allowedMethods'?: string[],
 *  'exposedHeaders'?: string[]|false,
 *  'maxAge'?: int|bool|null,
 *  'allowed_origins'?: string[],
 *  'allowed_origins_patterns'?: string[],
 *  'supports_credentials'?: bool,
 *  'allowed_headers'?: string[],
 *  'allowed_methods'?: string[],
 *  'exposed_headers'?: string[]|false,
 *  'max_age'?: int|bool|null
 * }
 */
```

--------------------------------

### Invalid allowedOrigins value throws \TypeError

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/errors.md

Passing a non-array value to 'allowedOrigins' (or other array options) triggers a \TypeError. The test 'itThrowsExceptionOnInvalidOriginsArray' covers this case.

```php
new CorsService(['allowedOrigins' => 'string']); // \TypeError
```

--------------------------------

### Invalid exposedHeaders value throws \TypeError

Source: https://github.com/fruitcake/php-cors/blob/master/_autodocs/errors.md

Passing a non-array, non-false value to 'exposedHeaders' triggers a \TypeError due to the typed array property. The test 'itThrowsExceptionOnInvalidExposedHeaders' covers this case.

```php
new CorsService(['exposedHeaders' => true]); // \TypeError
```
Tokens:
Raw