PHP实现跨域资源共享CORS全方案及响应头设置

<?php
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization");
?>

<?php
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    // 返回预检响应并立即终止脚本
    header("Access-Control-Allow-Origin: https://your-frontend.com");
    header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS");
    header("Access-Control-Allow-Headers: Content-Type, Authorization, X-API-Key");
    header("Access-Control-Max-Age: 86400"); // 缓存预检结果24小时
    exit; // 预检请求无需继续执行后续逻辑
}
?>

<?php
$allowedOrigins = [
    'https://example.com',
    'https://admin.example.com',
    'http://localhost:3000'
];

$origin = $_SERVER['HTTP_ORIGIN'] ?? '';

if (in_array($origin, $allowedOrigins)) {
    header("Access-Control-Allow-Origin: $origin");
    header("Access-Control-Allow-Credentials: true"); // 允许携带凭证
}

// 其他 CORS 头
header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization, X-API-Key");
?>

<?php
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
$method = $_SERVER['REQUEST_METHOD'];

// 定义合法来源
$trusted = ['https://a.com', 'https://b.com'];

if (in_array($origin, $trusted)) {
    header("Access-Control-Allow-Origin: $origin");
    
    if ($method === 'OPTIONS') {
        header("Access-Control-Allow-Methods: POST, GET, OPTIONS");
        header("Access-Control-Allow-Headers: Content-Type, Authorization");
        header("Access-Control-Max-Age: 600");
        exit;
    }
}

// 实际请求处理（如 POST）
if ($method === 'POST') {
    $input = json_decode(file_get_contents('php://input'), true);
    // 处理业务逻辑...
    echo json_encode(['status' => 'success']);
}
?>