src/Http/Middleware/Cors.php
public function analyze(RequestInterface $request): array
	{
		$serverOrigin = Factory::uri($this->settings[self::KEY_SERVER_ORIGIN]);

		// check 'Host' request
		if ($this->settings[self::KEY_IS_CHECK_HOST] && !$this->isSameHost($request, $serverOrigin)) {
			return $this->result(self::ERROR_NO_HOST_HEADER);
		}

		// Request handlers have common part (#6.1.1 - #6.1.2 and #6.2.1 - #6.2.2)

		// #6.1.1 and #6.2.1
		$requestOrigin = $this->getRequestOrigin($request);
		if ($requestOrigin === null || $requestOrigin === $this->getOriginFromUri($serverOrigin)) {
			return $this->result(self::TYPE_REQUEST_OUT_OF_CORS_SCOPE);
		}

		// #6.1.2 and #6.2.2
		if (
			!isset($this->settings[self::KEY_ALLOWED_ORIGINS][self::VALUE_ALLOW_ORIGIN_ALL]) &&
			!isset($this->settings[self::KEY_ALLOWED_ORIGINS][$requestOrigin])
		) {
			return $this->result(self::ERROR_ORIGIN_NOT_ALLOWED);
		}

		// Since this point handlers have their own path for
		// - simple CORS and actual CORS request (#6.1.3 - #6.1.4)
		// - pre-flight request (#6.2.3 - #6.2.10)

		if ($request->getMethod() === 'OPTIONS') {
			return $this->analyzeAsPreFlight($request, $requestOrigin);
		}

		return $this->analyzeAsRequest($requestOrigin);
	}
public function analyze(RequestInterface $request): array
	{
		$serverOrigin = Factory::uri($this->settings[self::KEY_SERVER_ORIGIN]);

		// check 'Host' request
		if ($this->settings[self::KEY_IS_CHECK_HOST] && !$this->isSameHost($request, $serverOrigin)) {
			return $this->result(self::ERROR_NO_HOST_HEADER);
		}

		// Request handlers have common part (#6.1.1 - #6.1.2 and #6.2.1 - #6.2.2)

		// #6.1.1 and #6.2.1
		$requestOrigin = $this->getRequestOrigin($request);
		if ($requestOrigin === null || $requestOrigin === $this->getOriginFromUri($serverOrigin)) {
			return $this->result(self::TYPE_REQUEST_OUT_OF_CORS_SCOPE);
		}

		// #6.1.2 and #6.2.2
		if (
			!isset($this->settings[self::KEY_ALLOWED_ORIGINS][self::VALUE_ALLOW_ORIGIN_ALL]) &&
			!isset($this->settings[self::KEY_ALLOWED_ORIGINS][$requestOrigin])
		) {
			return $this->result(self::ERROR_ORIGIN_NOT_ALLOWED);
		}

		// Since this point handlers have their own path for
		// - simple CORS and actual CORS request (#6.1.3 - #6.1.4)
		// - pre-flight request (#6.2.3 - #6.2.10)

		if ($request->getMethod() === 'OPTIONS') {
			return $this->analyzeAsPreFlight($request, $requestOrigin);
		}

		return $this->analyzeAsRequest($requestOrigin);
	}
public function analyze ( RequestInterface $ request ) : array { $ serverOrigin = Factory :: uri ( $ this -> settings [ self :: KEY_SERVER_ORIGIN ] ) ; // check 'Host' request
 if ( $ this -> settings [ self :: KEY_IS_CHECK_HOST ] && ! $ this -> isSameHost ( $ request , $ serverOrigin ) ) { return $ this -> result ( self :: ERROR_NO_HOST_HEADER ) ; } // Request handlers have common part (#6.1.1 - #6.1.2 and #6.2.1 - #6.2.2)
 // #6.1.1 and #6.2.1
 $ requestOrigin = $ this -> getRequestOrigin ( $ request ) ; if ( $ requestOrigin === null || $ requestOrigin === $ this -> getOriginFromUri ( $ serverOrigin ) ) { return $ this -> result ( self :: TYPE_REQUEST_OUT_OF_CORS_SCOPE ) ; } // #6.1.2 and #6.2.2
 if ( ! isset ( $ this -> settings [ self :: KEY_ALLOWED_ORIGINS ] [ self :: VALUE_ALLOW_ORIGIN_ALL ] ) && ! isset ( $ this -> settings [ self :: KEY_ALLOWED_ORIGINS ] [ $ requestOrigin ] ) ) { return $ this -> result ( self :: ERROR_ORIGIN_NOT_ALLOWED ) ; } // Since this point handlers have their own path for
 // - simple CORS and actual CORS request (#6.1.3 - #6.1.4)
 // - pre-flight request (#6.2.3 - #6.2.10)
 if ( $ request -> getMethod ( ) === 'OPTIONS' ) { return $ this -> analyzeAsPreFlight ( $ request , $ requestOrigin ) ; } return $ this -> analyzeAsRequest ( $ requestOrigin ) ; }
Set request for analysis.

@param RequestInterface $request

@return array
@see http://www.w3.org/TR/cors/#resource-processing-model
Set request for analysis .