mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-12 06:48:55 +00:00
ignacionelson
6e47d76ba6
Client file sharing, rebuilt from the ground up: a private area per client, resumable uploads, folders, groups and categories, sharing with expiry dates and download limits, comments, file versions, an activity log, a REST API, and sixteen languages. This repository begins here. ProjectSend 2 was developed privately, and that development history is not published — the previous generation remains available, with its own history, at projectsend/legacy. Free software under the GNU General Public License v2, or (at your option) any later version.
65 lines
2.2 KiB
PHP
65 lines
2.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
return [
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Cross-Origin Resource Sharing
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Published to replace Laravel's default, which answers every /api/*
|
|
| request with `Access-Control-Allow-Origin: *`.
|
|
|
|
|
| That default was not dangerous here — the API is bearer-token only,
|
|
| `supports_credentials` is false, and no browser holds a token — but it
|
|
| was inherited rather than chosen, and it grants something nothing
|
|
| needs: the API's consumers are server-side automation and native
|
|
| mobile apps, none of which are subject to CORS at all. A wildcard buys
|
|
| those callers nothing while leaving a browser-reachable door open for
|
|
| whatever the API grows into later.
|
|
|
|
|
| So the default here is *no* cross-origin browser access. A self-hoster
|
|
| building a browser front-end against their own install names their
|
|
| origin explicitly:
|
|
|
|
|
| API_ALLOWED_ORIGINS=https://app.example.com,https://staging.example.com
|
|
|
|
|
| Should credentialed cross-origin requests ever be wanted, note that
|
|
| `supports_credentials => true` may not be combined with a wildcard
|
|
| origin — which is the browser telling you to name the origins anyway.
|
|
|
|
|
*/
|
|
|
|
'paths' => ['api/*'],
|
|
|
|
'allowed_methods' => ['*'],
|
|
|
|
'allowed_origins' => array_values(array_filter(
|
|
explode(',', (string) env('API_ALLOWED_ORIGINS', '')),
|
|
static fn (string $origin): bool => trim($origin) !== '',
|
|
)),
|
|
|
|
'allowed_origins_patterns' => [],
|
|
|
|
'allowed_headers' => ['*'],
|
|
|
|
// Without this a browser client can read the body but not the headers
|
|
// that tell it how much allowance is left or when to retry — the two
|
|
// things a well-behaved client needs in order to back off.
|
|
'exposed_headers' => [
|
|
'X-RateLimit-Limit',
|
|
'X-RateLimit-Remaining',
|
|
'Retry-After',
|
|
],
|
|
|
|
'max_age' => 0,
|
|
|
|
// Bearer tokens only: cookies must never travel cross-origin to this
|
|
// API. See config/sanctum.php, where both `stateful` and `guard` are
|
|
// empty for the same reason.
|
|
'supports_credentials' => false,
|
|
|
|
];
|