- What is asm89/stack-cors used for?
- It is a lightweight PHP middleware library that adds Cross-Origin Resource Sharing headers to Stack-compatible and Symfony HttpKernel applications. It handles preflight OPTIONS requests and lets you configure allowed origins, methods, headers, credentials, and max-age caching. In Laravel it is not a native middleware; it is typically wrapped by a thin adapter if you specifically need its policy behavior.
- Is asm89/stack-cors a native Laravel middleware package?
- No. It is framework-agnostic Stack middleware built around Symfony HttpFoundation, and it does not implement Laravel's middleware contract directly. Laravel uses Symfony HttpFoundation, so it can fit behind a Laravel adapter, but Laravel's native CORS handling or a Laravel-specific package is usually the simpler choice.
- How do I install asm89/stack-cors in a Laravel project?
- Install it with Composer using the package name asm89/stack-cors, then verify that the resolved PHP and symfony/http-foundation constraints are compatible with your Laravel version. Because it is not a native Laravel middleware, you will need a wrapper that maps Laravel configuration into the package's CORS service options and runs it early in the middleware stack. Do not expose the Stack middleware directly in the Laravel pipeline unless you have confirmed the adapter behavior.
- Which Laravel and PHP versions are supported by asm89/stack-cors?
- The package itself is framework-agnostic and its compatibility is driven by Composer constraints for PHP and Symfony HttpFoundation rather than Laravel-specific version declarations. You must check the exact package version against your Laravel release and the Symfony major that Laravel resolves. The v2.4.0 release only widens the Symfony 8 constraint; it does not raise the PHP floor or add new Laravel integration features.
- How does asm89/stack-cors handle preflight OPTIONS requests?
- It provides automatic preflight request handling by responding to OPTIONS requests with the configured CORS policy before normal application routing or authentication logic runs. That makes it important to place the middleware or Laravel adapter early in the stack. You should still test preflight responses for each route group and method because misordered middleware can bypass or duplicate the headers.
- Can I configure allowed origins, methods, headers, credentials, and max-age with asm89/stack-cors?
- Yes. The package supports configurable allowed origins, methods, headers, credentials, and max-age caching as part of its CORS policy options. For Laravel, map those settings from a single configuration source into the package's service options so you do not create conflicting rules. Be especially careful with wildcard origins combined with credentials, which browsers reject or treat as insecure.
- Is v2.4.0 of asm89/stack-cors safe to upgrade to?
- v2.4.0 is a compatibility-only minor release that widens the Symfony constraint to admit Symfony 8; it does not add policy features or change the public API. It is low risk if your lockfile and dependency resolution are controlled, but a fresh composer update could pull Symfony 8 components into a project previously pinned to 7.x. Treat it as routine dependency hygiene and test your Laravel adapter after upgrading.
- Should I use asm89/stack-cors if Laravel already has native CORS or fruitcake/php-cors?
- Usually no, unless you specifically need asm89/stack-cors behavior or legacy StackPHP compatibility. Laravel-native CORS or a Laravel-specific package avoids an extra adapter and duplicate policy layers. If you already use this package, keep one source of truth and remove duplicate CORS rules at the app, web server, CDN, or gateway level.
- How do I test CORS headers and preflight behavior with asm89/stack-cors in Laravel?
- Build a request matrix covering allowed and denied origins, each HTTP method you expose, credentials, exposed headers, and max-age, then assert the response headers and OPTIONS status codes in feature tests. Also test middleware ordering because the CORS adapter must run before auth and routing for preflight requests. Validate the same matrix in staging behind your proxy or CDN, since header stripping can differ from local tests.
- What are the production risks of using asm89/stack-cors in Laravel?
- The main risks are CORS misconfiguration, duplicate CORS layers, wildcard-plus-credentials errors, stale preflight caching, proxy or CDN header stripping, and middleware ordering. The package is not an authentication or authorization boundary, so do not treat CORS headers as access control. Verify upstream ownership and maintenance, keep Composer audit and lockfile discipline, and define a rollback path if browser behavior regresses.