diff --git a/src/PhalconApi/Middleware/CorsMiddleware.php b/src/PhalconApi/Middleware/CorsMiddleware.php index 9d7fb94..a48da46 100644 --- a/src/PhalconApi/Middleware/CorsMiddleware.php +++ b/src/PhalconApi/Middleware/CorsMiddleware.php @@ -131,24 +131,34 @@ public function beforeHandleRoute(Event $event, \PhalconApi\Api $api) $origin = $this->request->getHeader('Origin'); $originDomain = $origin ? parse_url($origin, PHP_URL_HOST) : null; - if ($originDomain) { + if (!$originDomain) { + return; + } + + $allowed = false; - $allowed = in_array($allowedOrigin, $this->_allowedOrigins); + foreach ($this->_allowedOrigins as $allowedOrigin) { - if (false === $allowed) { - // Parse wildcards - $expression = '/^' . str_replace('\*', '(.+)', preg_quote($allowedOrigin, '/')) . '$/'; - if (preg_match($expression, $originDomain) == 1) { + // First try exact domain + if ($originDomain == $allowedOrigin) { - $allowed = true; - } + $allowed = true; + break; } + + // Parse wildcards + $expression = '/^' . str_replace('\*', '(.+)', preg_quote($allowedOrigin, '/')) . '$/i'; + if (preg_match($expression, $originDomain) == 1) { - if ($allowed) { - - $originValue = $origin; + $allowed = true; + break; } } + + if ($allowed) { + + $originValue = $origin; + } } if ($originValue != null) {