stack-cors

Re-support Symfony 4 & 5 and PHP 7.2+ (https://github.com/asm89/stack-cors/pull/99)

• Bug with Access-Control-Allow-Origin header is null then allowedOrigins is ['*'], supportsCredentials is true and Origin header doesn't set (#85)
• Do not check isSameHost to relax CORS detection #84

Revert to 1.x behaviour to reflect the allowed headers/methods instead of wildcards.

Added

• CORS headers are better cachable now, with correct Vary headers (#70, #74)

Changed

• CORS headers are added to non-Origin requests when possible (#73)
• Requests are no longer blocked by the server, only by the browser (#70)

Added typehints
Only send rest of the CORS headers when Origin passes

• CORB support
• Symfony 5 support

• Support Symfony 4
• Adds an option allowedOriginsPatterns that expects an array of regex strings. See https://github.com/asm89/stack-cors/pull/45

New release containing several improvements/bug fixes:

• Skip empty Access-Control-Request-Headers. Working around some browser bugs. https://github.com/asm89/stack-cors/pull/30
• Requests from the same origin are not modified anymore. https://github.com/asm89/stack-cors/pull/11
• Updated dependencies to 2017. E.g. php >= 5.5.9 and Symfony deps now have a lower bound of ~2.7. https://github.com/asm89/stack-cors/pull/41