I use to need to have CORS enabled on my Symfony projects.
There are so many available tips and tricks, but this one is my choice: https://blog.digital-craftsman.de/symfony-cors-listener/
I just arachive here a simplified copy of this, in case it has to desapear
in src/EventListener/CorsListener.php:
<?php
declare(strict_types=1);
namespace App\EventListener;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Event\ExceptionEvent;
use Symfony\Component\HttpKernel\Event\RequestEvent;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;
final class CorsListener implements EventSubscriberInterface
{
public static function getSubscribedEvents(): array
{
return [
KernelEvents::REQUEST => ['onKernelRequest', 9999],
KernelEvents::RESPONSE => ['onKernelResponse', 9999],
KernelEvents::EXCEPTION => ['onKernelException', 9999],
];
}
public function onKernelException(ExceptionEvent $event): void
{
$response = $event->getResponse();
if ($response) {
$response->headers->set('Access-Control-Allow-Origin', '*');
$response->headers->set('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH');
$response->headers->set('Access-Control-Allow-Headers', 'content-type');
}
}
public function onKernelRequest(RequestEvent $event): void
{
// Don't do anything if it's not the master request.
if (!$event->isMasterRequest()) {
return;
}
$request = $event->getRequest();
$method = $request->getRealMethod();
if (Request::METHOD_OPTIONS === $method) {
$response = new Response();
$event->setResponse($response);
}
}
public function onKernelResponse(ResponseEvent $event): void
{
// Don't do anything if it's not the master request.
if (!$event->isMasterRequest()) {
return;
}
$response = $event->getResponse();
if ($response) {
$response->headers->set('Access-Control-Allow-Origin', '*');
$response->headers->set('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH');
$response->headers->set('Access-Control-Allow-Headers', 'content-type');
}
}
}
//
Then in .../services.yml:
App\EventListener\CorsListener:
tags:
- { name: kernel.event_subscriber }