Handle OPTIONS requests in one place.

kohler · Feb 8, 2024 · 61220b8 · 61220b8
1 parent 7aca4d9
commit 61220b8
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 0 deletions.
diff --git a/index.php b/index.php
@@ -56,6 +56,12 @@ function handle_request($nav) {
 
 $nav = Navigation::get();
 
+// handle OPTIONS requests, including CORS preflight
+if ($_SERVER["REQUEST_METHOD"] === "OPTIONS") {
+    include("src/pages/p_api.php");
+    API_Page::go_options($nav);
+}
+
 // handle `/u/USERINDEX/`
 if ($nav->page === "u") {
     $unum = $nav->path_component(0);

diff --git a/src/pages/p_api.php b/src/pages/p_api.php
@@ -116,6 +116,36 @@ static function export_messages(JsonResult $jr) {
         return $ml;
     }
 
+    static function go_options(NavigationState $nav) {
+        if ($nav->page === "u"
+            && ($unum = $nav->path_component(0)) !== false
+            && ctype_digit($unum)) {
+            $nav->shift_path_components(2);
+        }
+        $ok = true;
+        if (($m = $_SERVER["HTTP_ACCESS_CONTROL_REQUEST_METHOD"] ?? null)) {
+            if ($nav->page === "api") {
+                $origin = $_SERVER["HTTP_ORIGIN"] ?? "*";
+                header("Access-Control-Allow-Origin: {$origin}");
+                if (($hdrs = $_SERVER["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"] ?? null)) {
+                    header("Access-Control-Allow-Headers: {$hdrs}");
+                }
+                header("Access-Control-Allow-Credentials: true");
+                header("Access-Control-Allow-Methods: OPTIONS, GET, HEAD, POST");
+                header("Access-Control-Max-Age: 86400");
+            } else if (in_array($nav->page, ["cacheable", "scorechart", "images", "scripts", "stylesheets"])) {
+                header("Access-Control-Allow-Origin: *");
+                header("Access-Control-Allow-Methods: OPTIONS, GET, HEAD");
+                header("Access-Control-Max-Age: 86400");
+            } else {
+                $ok = false;
+            }
+        } else {
+            header("Allow: OPTIONS, GET, HEAD, POST"); // XXX other methods?
+        }
+        http_response_code($ok ? 200 : 403);
+        exit;
+    }
 
     /** @param NavigationState $nav
      * @param Conf $conf */