Laravel Cors Laravel Package

Use the new fruitcake/php-cors stand-alone version instead of asm89/stack-cors. See https://github.com/fruitcake/php-cors/releases/tag/v1.0.0 for more information

Revert namespace change on minor version See https://github.com/fruitcake/laravel-cors/pull/558 and https://github.com/fruitcake/laravel-cors/pull/557

3.x will still use fruitcake/php-cors

Use the new fruitcake/php-cors stand-alone version instead of asm89/stack-cors. See https://github.com/fruitcake/php-cors/releases/tag/v1.0.0 for more information

To avoid memory leaks with Octane (https://github.com/fruitcake/laravel-cors/pull/469)

Add support for Laravel 8, drop unsupported versions.

Uses v2.0.1 of stack-cors, re-enables reflective headers instead of wildcards.

v2.0 (2020-05-11)

asm89/stack-cors 2.x is now used, with these notable changes:

Added

• CORS headers are better cachable now, with correct Vary headers (#https://github.com/asm89/stack-cors/pull/70, #https://github.com/asm89/stack-cors/pull/74)

Changed

• CORS headers are added to non-Origin requests when possible (#https://github.com/asm89/stack-cors/pull/73)
• Requests are no longer blocked by the server, only by the browser (#https://github.com/asm89/stack-cors/pull/70)

• Don't block CORS requests in Laravel, leave it to the browser
• Update Vary headers for better caching
• Use static/cacheable headers when possible

Validate config values when creating the Service, instead of when used.

php artisan vendor:publish --tag=cors

1.0.1

Breaking changes

• Adding the middleware on Route groups is no longer supported. You can use the new paths option to match your routes
• The config file has been changed from camelCase to snake_case, please update your own config.
• The deprecated Lumen ServiceProvider has been removed.
• There is no need to manually configure the cors config in Lumen.

Added

• The paths option is added to match certain routes only, while still using global middleware. This allows for better error handling.

Breaking changes

• The wildcard matcher is changed. You can use allowedOriginPatterns for your own patterns, or simple wildcards in the normal origins. Eg. *.laravel.com should still work.

Changes

• Uses upstream asm/stack-cors (see #195)
• Move tests to namespaces (See #277)