CROSS ORIGIN

@Alimotreb
@ali.bayat
@hesammousavi
@milad
@endworld
@SeyedMH.Mosav
سلام
من یه سایت دارم که اپ اندروید هم داره و هر دو با api کار میکنن و فریم ورکم لاراول هست.
1 - چطوری میتونم CROSS ORIGIN تنظیم کنم که اپ اندروید و سایتم به مشکل نخورن و مسایل امنیتی هم رعایت شده باشه؟
2 - میشه جوری تنظیم کرد که خودم با لوکال هم بتونم با api سایت کار کنم(موقت)؟

برای CROSS ORIGIN من از midleware زیر استفاده میکنم :

<?php

namespace AppHttpMiddleware;

use Closure;

class EnableCors
{
    private static $allowedOriginsWhitelist = [
        'https://www.mysite.ir'
    ];

    // All the headers must be a string

    private static $allowedOrigin = '*';

    private static $allowedMethods = 'OPTIONS, GET, POST, PUT, PATCH, DELETE';

    private static $allowCredentials = 'true';

    private static $allowedHeaders = [
        'Content-Type',
        'X-Auth-Token',
        'Origin',
        'Authorization',
        "accept",

    ];

    /**
     * Handle an incoming request.
     *
     * @param  IlluminateHttpRequest  $request
     * @param  Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if (! $this->isCorsRequest($request))
        {
            return $next($request);
        }

        static::$allowedOrigin = $this->resolveAllowedOrigin($request);

        static::$allowedHeaders = $this->resolveAllowedHeaders($request);

        $headers = [
            'Access-Control-Allow-Origin'       => static::$allowedOrigin,
            'Access-Control-Allow-Methods'      => static::$allowedMethods,
            'Access-Control-Allow-Headers'      => static::$allowedHeaders,
            'Access-Control-Allow-Credentials'  => static::$allowCredentials,
        ];

        // For preflighted requests
        if ($request->getMethod() === 'OPTIONS')
        {
            return response('', 200)->withHeaders($headers);
        }

        $response = $next($request)->withHeaders($headers);

        return $response;
    }

    /**
     * Incoming request is a CORS request if the Origin
     * header is set and Origin !== Host
     *
     * @param $request
     * @return bool
     */
    private function isCorsRequest($request)
    {

        $requestHasOrigin = $request->headers->has('Origin');
        return true;
        if ($requestHasOrigin)
        {
            $origin = $request->headers->get('Origin');

            $host = $request->getSchemeAndHttpHost();

            if ($origin !== $host)
            {
                return true;
            }
        }

        return false;
    }

    /**
     * Dynamic resolution of allowed origin since we can't
     * pass multiple domains to the header. The appropriate
     * domain is set in the Access-Control-Allow-Origin header
     * only if it is present in the whitelist.
     *
     * @param $request
     * @return string
     */
    private function resolveAllowedOrigin($request)
    {
        $allowedOrigin = static::$allowedOrigin;

        // If origin is in our $allowedOriginsWhitelist
        // then we send that in Access-Control-Allow-Origin

        $origin = $request->headers->get('Origin');

        if (in_array($origin, static::$allowedOriginsWhitelist))
        {
            $allowedOrigin = $origin;
        }

        return $allowedOrigin;
    }

    /**
     * Take the incoming client request headers
     * and return. Will be used to pass in Access-Control-Allow-Headers
     *
     * @param $request
     * @return mixed
     */
    private function resolveAllowedHeaders($request)
    {
        $allowedHeaders = $request->headers->get('Access-Control-Request-Headers');

        return $allowedHeaders;
    }
}