src/CorsService.php
protected function isHeadersAllowed(array $headers)
    {
        /**
         * Webkit browsers are known to include simple headers in access-control-request-headers.
         * We need to remove these so they aren't considered in the check for allowed headers.
         * @see http://stackoverflow.com/questions/17330302/why-non-custom-headers-in-access-control-request-headers
         */
        // Strip out any requests for simple headers
        $headers = array_udiff(
            $headers,
            $this->simpleHeaders,
            'strcasecmp'
        );

        // Check for any access-control-request-headers not in allowed headers, using case-insensitive comparison
        return array_udiff(
            $headers,
            $this->config['allowHeaders'],
            'strcasecmp'
        ) === [];
    }
protected function isHeadersAllowed(array $headers)
    {
        /**
         * Webkit browsers are known to include simple headers in access-control-request-headers.
         * We need to remove these so they aren't considered in the check for allowed headers.
         * @see http://stackoverflow.com/questions/17330302/why-non-custom-headers-in-access-control-request-headers
         */
        // Strip out any requests for simple headers
        $headers = array_udiff(
            $headers,
            $this->simpleHeaders,
            'strcasecmp'
        );

        // Check for any access-control-request-headers not in allowed headers, using case-insensitive comparison
        return array_udiff(
            $headers,
            $this->config['allowHeaders'],
            'strcasecmp'
        ) === [];
    }
protected function isHeadersAllowed ( array $ headers ) { /**
         * Webkit browsers are known to include simple headers in access-control-request-headers.
         * We need to remove these so they aren't considered in the check for allowed headers.
         * @see http://stackoverflow.com/questions/17330302/why-non-custom-headers-in-access-control-request-headers
         */ // Strip out any requests for simple headers $ headers = array_udiff ( $ headers , $ this -> simpleHeaders , 'strcasecmp' ) ; // Check for any access-control-request-headers not in allowed headers, using case-insensitive comparison return array_udiff ( $ headers , $ this -> config [ 'allowHeaders' ] , 'strcasecmp' ) === [ ] ; }
Check if ALL request headers are allowed

@param array $headers
@return bool
Check if ALL request headers are allowed