EnableCrossRequestMiddleware.php 2.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354
  1. <?php
  2. // +----------------------------------------------------------------------
  3. // | LARAVEL8.0 框架 [ LARAVEL ][ RXThinkCMF ]
  4. // +----------------------------------------------------------------------
  5. // | 版权所有 2017~2021 LARAVEL研发中心
  6. // +----------------------------------------------------------------------
  7. // | 官方网站: http://www.laravel.cn
  8. // +----------------------------------------------------------------------
  9. // | Author: laravel开发员 <laravel.qq.com>
  10. // +----------------------------------------------------------------------
  11. namespace App\Http\Middleware;
  12. use Closure;
  13. use Illuminate\Http\Request;
  14. /**
  15. * 跨域解决方案
  16. * @author laravel开发员
  17. * @since 2021/1/10
  18. * Class EnableCrossRequestMiddleware
  19. * @package App\Http\Middleware
  20. */
  21. class EnableCrossRequestMiddleware
  22. {
  23. /**
  24. * Handle an incoming request.
  25. *
  26. * @param \Illuminate\Http\Request $request
  27. * @param \Closure $next
  28. * @return mixed
  29. */
  30. public function handle(Request $request, Closure $next)
  31. {
  32. $response = $next($request);
  33. $origin = $request->server('HTTP_ORIGIN') ? $request->server('HTTP_ORIGIN') : '';
  34. $allow_origin = [];
  35. if (empty($allow_origin) || in_array($origin, $allow_origin)) {
  36. //允许所有资源跨域
  37. $response->headers->set('Access-Control-Allow-Origin', $origin);
  38. // 允许通过的响应报头
  39. $response->headers->set('Access-Control-Allow-Headers', 'Origin, Content-Type, Cookie, X-CSRF-TOKEN, Accept, Authorization, X-XSRF-TOKEN');
  40. // 允许axios获取响应头中的Authorization
  41. $response->headers->set('Access-Control-Expose-Headers', 'Authorization, authenticated');
  42. // 允许的请求方法
  43. $response->headers->set('Access-Control-Allow-Methods', 'GET, POST, PATCH, PUT, OPTIONS, DELETE');
  44. //允许的请求方法
  45. $response->headers->set('Allow', 'GET, POST, PATCH, PUT, OPTIONS, delete');
  46. // 运行客户端携带证书式访问
  47. $response->headers->set('Access-Control-Allow-Credentials', 'true');
  48. }
  49. return $response;
  50. }
  51. }