CORS Api with symfony

I advise you to use NelmioCorsBundle:

https://github.com/nelmio/NelmioCorsBundle

This bundle allows you to send Cross-Origin Resource Sharing headers with ACL-style per-URL configuration.

Is very useful for CORS problem

I'm not sure that's the right way, but I resolved for me:

1. Create new event subscriber (like ResponseSubscriber)
2. Listen KernelEvents::RESPONSE event
3. In your handler add the following:

if ($event->getRequest()->getMethod() === 'OPTIONS') {
    $event->setResponse(
            new Response('', 204, [
                'Access-Control-Allow-Origin' => '*',
                'Access-Control-Allow-Credentials' => 'true',
                'Access-Control-Allow-Methods' => 'GET, POST, PUT, DELETE, OPTIONS',
                'Access-Control-Allow-Headers' => 'DNT, X-User-Token, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type',
                'Access-Control-Max-Age' => 1728000,
                'Content-Type' => 'text/plain charset=UTF-8',
                'Content-Length' => 0
            ])
        );
    return ;
}

I used Symfony 5 and Wordpress this code in the file public/index.php works perfectly.

header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: X-API-KEY, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method");
header("Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE");
header("Allow: GET, POST, OPTIONS, PUT, DELETE");
$method = $_SERVER['REQUEST_METHOD'];
if ($method == "OPTIONS") {
    die();
}

Also, I remove package cors .. This Bundle doesn't work for me

https://github.com/nelmio/NelmioCorsBundle

or

if you want to write a cors package for yourself, here some tips:

• the 'to Checked' Origin will be automaticly embedded by any browser in HTTP_ORIGIN
• do not use a sole '*' wildcard
• you can cut of the request processing early if u use a request & response listener (if you want)
• do not only send it with OPTIONS methods (some browser may want it in GET or even POST requests.)

manage your Origin cors list in some config yaml files for example. and validate the HTTP_ORIGIN if it matches your cors list. then send the HTTP_ORIGIN AS "VALID" back.

Access-Control-Allow-Origin: THE_HTTP_ORIGIN_HERE

+ the other Access-Control header. see https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS for more in depth information.

in the end, this mostly the same workflow that https://github.com/nelmio/NelmioCorsBundle uses. my advice: safe your time ;)

TLDR; don't take cors lightly by just use a wildcard, over a bad cors implementation every attacker site can fish a active session from your users.

• step1: user uses your API, has a session cookie,
• step2: user visits a random site, which embed code who just requested the browser to trigger a request directly to your api with the cookie credentals.
• step3: your api must detect this as a attack and not answer with a *.

the victim browser, its not possible to send a forged HTTP_ORIGIN via javascript.