Skip to content

Commit

Permalink
Updates all pages of documentation to use writing standard
Browse files Browse the repository at this point in the history
Signed-off-by: Frank Brückner <[email protected]>
  • Loading branch information
froschdesign authored and weierophinney committed Sep 2, 2020
1 parent c21c4b4 commit 83f8df6
Show file tree
Hide file tree
Showing 2 changed files with 61 additions and 38 deletions.
47 changes: 28 additions & 19 deletions docs/book/v1/intro.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,15 @@
# mezzio-cors
# Introduction

CORS subcomponent for [Mezzio](https://github.com/mezzio/mezzio).
This component creates CORS details for your application. If the
`CorsMiddleware` detects a `CORS preflight`, the middleware will start do detect
the proper `CORS` configuration. The `Router` is being used to detect every
allowed request method by executing a route match with all possible request
methods. Therefore, for every preflight request, there is at least one `Router`
request (depending on the configuration of the route, it might be just one or we
are executing a check for **every** request method).

This extension creates CORS details for your application. If the `CorsMiddleware` detects a `CORS preflight`, the middleware will start do detect the proper `CORS` configuration.
The `Router` is being used to detect every allowed request method by executing a route match with all possible request methods. Therefore, for every preflight request, there is at least one `Router` request (depending on the configuration of the route, it might be just one or we are executing a check for **every** request method).

Here is a list of the request methods being checked for the `CORS preflight` information:
Here is a list of the request methods being checked for the `CORS preflight`
information:

- DELETE
- GET
Expand All @@ -16,22 +20,27 @@ Here is a list of the request methods being checked for the `CORS preflight` inf
- PUT
- TRACE

The order of the headers might vary, depending on what request method is being requested with the `CORS preflight` request.
In the end, the response contains **every** possible request method of the route due to what the router tells the `ConfigurationLocator`.


The allowed origins can be configured as strings which can be matched with [`fnmatch`](https://www.php.net/manual/en/function.fnmatch.php). Therefore, wildcards are possible.

## Installation
The order of the headers might vary, depending on what request method is being
requested with the `CORS preflight` request. In the end, the response contains
**every** possible request method of the route due to what the router tells the
`ConfigurationLocator`.

```bash
$ composer require mezzio/mezzio-cors
```
The allowed origins can be configured as strings which can be matched with
[`fnmatch`](https://www.php.net/manual/en/function.fnmatch.php). Therefore,
wildcards are possible.

## Features

mezzio-cors provides a [`CorsMiddleware`](middleware.md) which works out of the box with once created a global configuration file. It can safely be added to the projects pipeline as CORS details are needed for *every* request (in case its a CORS request).
mezzio-cors provides a [`CorsMiddleware`](middleware.md) which works out of the
box with once created a global configuration file. It can safely be added to the
projects pipeline as CORS details are needed for *every* request (in case its a
CORS request).

It uses the [mezzio-router](https://github.com/mezzio/mezzio-router) to match the incoming URI. It starts with the HTTP request method which is provided by the Request via the `Access-Control-Request-Method` header and checks *all* request methods until it matches a route. If that route states to be explicit, the response is created immediately.
It uses the [mezzio-router](https://github.com/mezzio/mezzio-router) to match
the incoming URI. It starts with the HTTP request method which is provided by
the Request via the `Access-Control-Request-Method` header and checks *all*
request methods until it matches a route. If that route states to be explicit,
the response is created immediately.

If the route is not explicit, *all* request methods are checked to provide a list of possible request methods to the client.
If the route is not explicit, *all* request methods are checked to provide a
list of possible request methods to the client.
52 changes: 33 additions & 19 deletions docs/book/v1/middleware.md
Original file line number Diff line number Diff line change
@@ -1,13 +1,17 @@
# CORS Middleware
# Middleware

mezzio-cors provides middleware consuming
[PSR-7](http://www.php-fig.org/psr/psr-7/) HTTP message instances, via implementation of [PSR-15](https://www.php-fig.org/psr/psr-15/) interfaces.
[PSR-7](http://www.php-fig.org/psr/psr-7/) HTTP message instances, via
implementation of [PSR-15](https://www.php-fig.org/psr/psr-15/) interfaces.

This middleware checks, if the incoming request is a CORS request. If so, it makes a distinction between a so called [Preflight request](#preflight-request) or the [regular request](#cors-request).
This middleware checks, if the incoming request is a CORS request. If so, it
makes a distinction between a so called [Preflight request](#preflight-request)
or the [regular request](#cors-request).

## Preflight request
## Preflight Request

A Preflight request should be a light call which provides the Browser with the CORS informations it needs to execute the regular (CORS) request.
A Preflight request should be a light call which provides the Browser with the
CORS informations it needs to execute the regular (CORS) request.

These informations are:
- Domain accepted for executing CORS request?
Expand All @@ -16,13 +20,16 @@ These informations are:
- Which Headers are provided in the response?
- Which HTTP Methods are accepted by that Endpoint?

## CORS request
## CORS Request

The CORS request is the actual request. That request SHOULD to be already verified. If its not verified by a previous [Preflight request](#preflight-request), the request will be aborted with a `403 Forbidden` response.
The CORS request is the actual request. That request SHOULD to be already
verified. If its not verified by a previous [Preflight request](#preflight-request),
the request will be aborted with a `403 Forbidden` response.

## Configuration

There are 2 ways of configuring CORS in your project. Either create a global configuration file like `cors.global.php` or add a route specific configuration.
There are 2 ways of configuring CORS in your project. Either create a global
configuration file like `cors.global.php` or add a route specific configuration.

On the project level, you can only configure the following Headers:

Expand All @@ -34,7 +41,9 @@ On the project level, you can only configure the following Headers:
| `credentials_allowed` | bool | Access-Control-Allow-Credentials
| `exposed_headers` | string[] | Access-Control-Exposed-Headers

On the route level, you can configure all of the projects configuration settings and if the configuration of the route should either override the project configuration (default) or merge it.
On the route level, you can configure all of the projects configuration settings
and if the configuration of the route should either override the project
configuration (default) or merge it.


| Configuration | Type | Header
Expand All @@ -47,13 +56,16 @@ On the route level, you can configure all of the projects configuration settings
| `credentials_allowed` | bool | Access-Control-Allow-Credentials
| `exposed_headers` | string[] | Access-Control-Exposed-Headers

The parameter `overrides_project_configuration` handles the way how the configuration is being merged. The default setting is `true` to ensure that a route configuration has to specify every information it will provide.
The parameter `overrides_project_configuration` handles the way how the
configuration is being merged. The default setting is `true` to ensure that a
route configuration has to specify every information it will provide.

The parameter `explicit` tells the `ConfigurationLocator` to stop trying other request methods to match the same route because there wont be any other method.
The parameter `explicit` tells the `ConfigurationLocator` to stop trying other
request methods to match the same route because there wont be any other method.

### Examples for project configurations
### Examples for Project Configurations

#### Allow every origin
#### Allow Every Origin

```php
<?php
Expand All @@ -73,7 +85,7 @@ return [
];
```

#### Allow every origin from a specific domain and its subdomains
#### Allow Every Origin from a Specific Domain and Its Subdomains

```php
<?php
Expand All @@ -94,9 +106,9 @@ return [
];
```

### Examples for route configurations
### Examples for Route Configurations

#### Make the configuration explicit to avoid multiple router match requests
#### Make the Configuration Explicit to Avoid Multiple Router Match Requests

```php
<?php
Expand Down Expand Up @@ -145,7 +157,8 @@ return [
];
```

Result of this configuration for the `CORS preflight` of `/foo` for the upcoming `GET` request will look like this:
Result of this configuration for the `CORS preflight` of `/foo` for the upcoming
`GET` request will look like this:

| Configuration | Parameter |
|:------------- |:-------------:|
Expand All @@ -158,7 +171,7 @@ Result of this configuration for the `CORS preflight` of `/foo` for the upcoming

**Did you note the missing `DELETE`? This is because of the `explicit` flag! Also note the empty `exposed_headers` which is due to the project overriding (`overrides_project_configuration`) parameter.**

#### Enable project merging
#### Enable Project Merging

```php
<?php
Expand Down Expand Up @@ -206,7 +219,8 @@ return [
];
```

Result of this configuration for the `CORS preflight` of `/foo` for the upcoming `GET` request will look like this:
Result of this configuration for the `CORS preflight` of `/foo` for the upcoming
`GET` request will look like this:

| Configuration | Parameter |
|:-------------|:-------------:|
Expand Down

0 comments on commit 83f8df6

Please sign in to comment.