- What is medz/cors and what does it do?
- medz/cors is a PHP CORS middleware package that adds Cross-Origin Resource Sharing headers and handles preflight OPTIONS requests. It provides a thin abstraction across Laravel, Lumen, PSR-15, Swoft, Slim, and ThinkPHP. You configure allowed origins, methods, headers, credentials, and max-age, then register the middleware in your HTTP stack.
- How do I install and register medz/cors in Laravel?
- Install it with Composer using composer require medz/cors. Register the package service provider or add its middleware to your HTTP kernel or middleware stack, depending on your Laravel version. Then publish and edit the configuration file to set allowed origins, methods, headers, credentials, and max-age. Check the README for the exact provider and middleware class names for your framework version.
- Is medz/cors still maintained?
- No. The repository is archived and the final release dates to May 2020, so there are no upstream security or compatibility patches. The 272 GitHub stars reflect historical adoption rather than current maintenance. Treat it as an unmaintained dependency and plan to replace it with framework-native CORS handling.
- Does medz/cors support Laravel 9, 10, or 11?
- The package predates modern Laravel CORS handling, and its last release was in May 2020. Laravel 9 and later include native CORS support, and Laravel absorbed fruitcake/laravel-cors as its built-in HandleCors middleware. For Laravel 9, 10, or 11 you should use the framework's config/cors.php and HandleCors instead of medz/cors.
- How do I configure allowed origins, methods, headers, credentials, and max-age in medz/cors?
- Configuration is handled through the package's published config file, where you define allowed origins, allowed methods, allowed headers, exposed headers, credentials support, and max-age. You can typically use wildcards or explicit lists for origins and headers. Because the package is archived, verify the exact option names against the README for your target framework. Keep credentials disabled when using wildcard origins to avoid invalid or insecure CORS responses.
- How does medz/cors handle preflight OPTIONS requests?
- The middleware intercepts OPTIONS requests at the HTTP kernel or middleware boundary before routing reaches your controllers. It responds with the configured Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Max-Age headers. This means your application routes do not need to define explicit OPTIONS handlers for CORS preflight.
- Should I use medz/cors or Laravel's built-in CORS middleware?
- For Laravel 9 and later, use the built-in HandleCors middleware with config/cors.php, or fruitcake/laravel-cors on Laravel 9–10 if you need the package form. They are maintained in lockstep with the framework and covered by Laravel's test matrix. medz/cors is archived and only makes sense if you are maintaining a legacy application that already depends on it.
- Can I use medz/cors with Lumen, Slim, PSR-15, Swoft, or ThinkPHP?
- The package advertises support for Lumen, Slim, PSR-15, Swoft, and ThinkPHP alongside Laravel. However, several of those framework targets are dormant or have changed their middleware contracts since the package's last release in May 2020. PSR-15 signature drift across psr/http-server-middleware versions is a real compatibility risk. For new projects, use a maintained middleware or a small hand-rolled PSR-15 middleware instead.
- How do I test CORS preflight and headers with medz/cors?
- Write HTTP-level assertions that send OPTIONS and actual requests and check the Access-Control-Allow-Origin, Allow-Methods, Allow-Headers, Allow-Credentials, and Max-Age response headers. Capture your current expected behavior before any migration so you can compare the native middleware output. Run these assertions in CI against preflight response codes and disallowed origins. This is especially important when swapping medz/cors for framework-native CORS handling.
- Is medz/cors safe for production use?
- CORS misconfiguration is a genuine security surface, and an archived package offers no remediation channel for defects. Risks include wildcard origins combined with credentials, reflected Origin headers, and overly permissive Access-Control-Allow-Headers settings. The code is small enough to audit, but adopting it means owning a fork permanently. For high-blast-radius HTTP boundary code, prefer a maintained framework-native middleware.