35 lines
883 B
PHP
35 lines
883 B
PHP
<?php
|
|
|
|
return [
|
|
/*
|
|
| Cross-Origin Resource Sharing for the Verde API.
|
|
|
|
|
| Same-origin requests (admin web on waste.test) don't need CORS at all.
|
|
| Customer-facing Next.js site lives at CUSTOMER_APP_URL — likely a
|
|
| different domain (app.verde.ph). It needs CORS + credentials so
|
|
| the Next.js auth-proxy route handlers can attach the cookie.
|
|
*/
|
|
|
|
'paths' => ['api/*', 'sanctum/csrf-cookie', 'broadcasting/auth'],
|
|
|
|
'allowed_methods' => ['*'],
|
|
|
|
'allowed_origins' => array_filter(array_merge(
|
|
[env('CUSTOMER_APP_URL')],
|
|
explode(',', (string) env('EXTRA_CORS_ORIGINS', '')),
|
|
)),
|
|
|
|
'allowed_origins_patterns' => [
|
|
'#^http://localhost:\d+$#',
|
|
'#^http://127\.0\.0\.1:\d+$#',
|
|
],
|
|
|
|
'allowed_headers' => ['*'],
|
|
|
|
'exposed_headers' => [],
|
|
|
|
'max_age' => 0,
|
|
|
|
'supports_credentials' => true,
|
|
];
|