fipamo/brain/utility/HandleCors.php

<?php

namespace brain\utility;

use brain\data\Settings;

class HandleCors
{
    public function __construct()
    {
        //look to see if settings file exists. kinda important
        if (file_exists("../config/settings.json")) {
            //check settings to see if external api access is allowed
            $config = new Settings();
            $settings = $config->getSettings();
            if ($settings["global"]["externalAPI"]) {
                //echo "API STATUS: " . $settings["global"]["externalAPI"];
                if ($settings["global"]["externalAPI"] == "true") {
                    //echo "API ACCESS ACTIVE";
                    // checks to see if origin is set
                    if (isset($_SERVER["HTTP_ORIGIN"])) {
                        // You can decide if the origin in $_SERVER['HTTP_ORIGIN'] is something you want to allow, or as we do here, just allow all
                        header("Access-Control-Allow-Origin: {$_SERVER["HTTP_ORIGIN"]}");
                    } else {
                        //No HTTP_ORIGIN set, so we allow any. You can disallow if needed here
                        //never allow just any domain, so turn CORS off if no No HTTP_ORIGIN is set
                        //header("Access-Control-Allow-Origin: *");
                    }

                    header("Access-Control-Allow-Credentials: true");
                    header("Access-Control-Max-Age: 600"); // cache for 10 minutes

                    if ($_SERVER["REQUEST_METHOD"] == "OPTIONS") {
                        if (isset($_SERVER["HTTP_ACCESS_CONTROL_REQUEST_METHOD"])) {
                            header(
                                "Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE, PUT"
                            );
                        } //Make sure you remove those you do not want to support

                        if (isset($_SERVER["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"])) {
                            header(
                                "Access-Control-Allow-Headers: {$_SERVER["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"]}"
                            );
                        }

                        //Just exit with 200 OK with the above headers for OPTIONS method
                        exit(0);
                    }
                } else {
                    //echo "API ACCESS ACTIVE";
                }
            } else {
                //value doesn't exist, so whatevs
                //echo "API ACCESS VALUE NOT PRESENT";
            }
        } else {
            //init state, so chill
        }
    }
}