Reflect headers/methods instead of wildcard (#81)

Author: barryvdh

src/CorsService.php

@@ -166,12 +166,8 @@ private function isSingleOriginAllowed(): bool
     private function configureAllowedMethods(Response $response, Request $request)
     {
         if ($this->options['allowedMethods'] === true) {
-            if ($this->options['supportsCredentials']) {
-                $allowMethods = strtoupper($request->headers->get('Access-Control-Request-Method'));
-                $this->varyHeader($response, 'Access-Control-Request-Method');
-            } else {
-                $allowMethods = '*';
-            }
+            $allowMethods = strtoupper($request->headers->get('Access-Control-Request-Method'));
+            $this->varyHeader($response, 'Access-Control-Request-Method');
         } else {
             $allowMethods = implode(', ', $this->options['allowedMethods']);
         }
@@ -182,12 +178,8 @@ private function configureAllowedMethods(Response $response, Request $request)
     private function configureAllowedHeaders(Response $response, Request $request)
     {
         if ($this->options['allowedHeaders'] === true) {
-            if ($this->options['supportsCredentials']) {
-                $allowHeaders = $request->headers->get('Access-Control-Request-Headers');
-                $this->varyHeader($response, 'Access-Control-Request-Headers');
-            } else {
-                $allowHeaders = '*';
-            }
+            $allowHeaders = $request->headers->get('Access-Control-Request-Headers');
+            $this->varyHeader($response, 'Access-Control-Request-Headers');
         } else {
             $allowHeaders = implode(', ', $this->options['allowedHeaders']);
         }

tests/CorsTest.php

@@ -89,7 +89,8 @@ public function it_returns_allow_headers_header_on_allow_all_headers_request()
         $response = $app->handle($request);
 
         $this->assertEquals(204, $response->getStatusCode());
-        $this->assertEquals('*', $response->headers->get('Access-Control-Allow-Headers'));
+        $this->assertEquals('Foo, BAR', $response->headers->get('Access-Control-Allow-Headers'));
+        $this->assertEquals('Access-Control-Request-Headers, Access-Control-Request-Method', $response->headers->get('Vary'));
     }
 
     /**
@@ -395,7 +396,9 @@ public function it_returns_valid_preflight_request_with_allow_methods_all()
 
         $this->assertTrue($response->headers->has('Access-Control-Allow-Methods'));
         // it will return the Access-Control-Request-Method pass in the request
-        $this->assertEquals('*', $response->headers->get('Access-Control-Allow-Methods'));
+        $this->assertEquals('GET', $response->headers->get('Access-Control-Allow-Methods'));
+        $this->assertEquals('Access-Control-Request-Method', $response->headers->get('Vary'));
+
     }
 
     /**