middlewares/filters/request/Cors.php
protected function prepareAllowHeaders($type, $requestHeaders, &$responseHeaders)
    {
        $requestHeaderField = 'Access-Control-Request-'.$type;
        $responseHeaderField = 'Access-Control-Allow-'.$type;
        if (!isset($requestHeaders[$requestHeaderField], $this->_cors[$requestHeaderField])) {
            return;
        }
        if (isset($this->_cors[$requestHeaderField]) && in_array('*', $this->_cors[$requestHeaderField])) {
            $responseHeaders[$responseHeaderField] = $this->headerize($requestHeaders[$requestHeaderField]);
        } else {
            $requestedData = preg_split('/[\\s,]+/', $requestHeaders[$requestHeaderField], -1, PREG_SPLIT_NO_EMPTY);
            $acceptedData = array_uintersect($requestedData, $this->_cors[$requestHeaderField], 'strcasecmp');
            if (!empty($acceptedData)) {
                $responseHeaders[$responseHeaderField] = implode(', ', $acceptedData);
            }
        }
    }
protected function prepareAllowHeaders($type, $requestHeaders, &$responseHeaders)
    {
        $requestHeaderField = 'Access-Control-Request-'.$type;
        $responseHeaderField = 'Access-Control-Allow-'.$type;
        if (!isset($requestHeaders[$requestHeaderField], $this->_cors[$requestHeaderField])) {
            return;
        }
        if (isset($this->_cors[$requestHeaderField]) && in_array('*', $this->_cors[$requestHeaderField])) {
            $responseHeaders[$responseHeaderField] = $this->headerize($requestHeaders[$requestHeaderField]);
        } else {
            $requestedData = preg_split('/[\\s,]+/', $requestHeaders[$requestHeaderField], -1, PREG_SPLIT_NO_EMPTY);
            $acceptedData = array_uintersect($requestedData, $this->_cors[$requestHeaderField], 'strcasecmp');
            if (!empty($acceptedData)) {
                $responseHeaders[$responseHeaderField] = implode(', ', $acceptedData);
            }
        }
    }
protected function prepareAllowHeaders ( $ type , $ requestHeaders , & $ responseHeaders ) { $ requestHeaderField = 'Access-Control-Request-' . $ type ; $ responseHeaderField = 'Access-Control-Allow-' . $ type ; if ( ! isset ( $ requestHeaders [ $ requestHeaderField ] , $ this -> _cors [ $ requestHeaderField ] ) ) { return ; } if ( isset ( $ this -> _cors [ $ requestHeaderField ] ) && in_array ( '*' , $ this -> _cors [ $ requestHeaderField ] ) ) { $ responseHeaders [ $ responseHeaderField ] = $ this -> headerize ( $ requestHeaders [ $ requestHeaderField ] ) ; } else { $ requestedData = preg_split ( '/[\\s,]+/' , $ requestHeaders [ $ requestHeaderField ] , - 1 , PREG_SPLIT_NO_EMPTY ) ; $ acceptedData = array_uintersect ( $ requestedData , $ this -> _cors [ $ requestHeaderField ] , 'strcasecmp' ) ; if ( ! empty ( $ acceptedData ) ) { $ responseHeaders [ $ responseHeaderField ] = implode ( ', ' , $ acceptedData ) ; } } }
Handle classic CORS request to avoid duplicate code.

@param string $type            the kind of headers we would handle
@param array  $requestHeaders  CORS headers request by client
@param array  $responseHeaders CORS response headers sent to the client
Handle classic CORS request to avoid duplicate code .