kefu/app/common/middleware/Cors.php

<?php
namespace app\common\middleware;

use Closure;
use think\Response;

/**
 * 全局跨域处理
 */
class Cors
{
    /**
     * 生成统一的跨域响应头。
     *
     * 除中间件正常响应外，shutdown() 这类提前终止的响应也需要复用，
     * 否则浏览器会把真实的登录/权限错误误报为 CORS 错误。
     */
    public static function headers($request): array
    {
        $origin = $request->header('origin', '');
        $origin = trim(str_replace(["\r", "\n"], '', $origin));

        $requestedHeaders = $request->header('access-control-request-headers', '');
        $requestedHeaders = trim(str_replace(["\r", "\n"], '', $requestedHeaders));
        $allowedHeaders = [
            'Origin',
            'X-Requested-With',
            'Content-Type',
            'Accept',
            'Authorization',
            'AuthToken',
            'SessionId',
            'Lang',
            'Accept-Language',
            'ClientId',
            'Cid',
            'X-Im-AppId',
            'X-Im-Sign',
            'X-Im-TimeStamp',
        ];
        if ($requestedHeaders !== '') {
            $allowedHeaders[] = $requestedHeaders;
        }

        $headers = [
            'Access-Control-Allow-Origin' => $origin === '' ? '*' : $origin,
            'Access-Control-Allow-Methods' => 'GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD',
            'Access-Control-Allow-Headers' => implode(', ', $allowedHeaders),
            'Access-Control-Expose-Headers' => '*',
            'Access-Control-Max-Age' => '86400',
        ];

        if ($origin !== '') {
            $headers['Access-Control-Allow-Credentials'] = 'true';
            $headers['Vary'] = 'Origin';
        }

        if ($request->header('access-control-request-private-network') === 'true') {
            $headers['Access-Control-Allow-Private-Network'] = 'true';
        }

        return $headers;
    }

    public function handle($request, Closure $next)
    {
        $headers = self::headers($request);

        if (strtoupper($request->method()) === 'OPTIONS') {
            return Response::create('', 'html', 204)->header($headers);
        }

        return $next($request)->header($headers);
    }
}