Comprehensive Guide to Implementing CORS in SLIM PHP Framework

Background of Cross-Origin Resource Sharing Issues

In modern web development, frontend applications and backend APIs are often deployed on different domains or ports, creating the need for Cross-Origin Resource Sharing (CORS). When frontend frameworks like Angular.js call RESTful services built with SLIM PHP framework, browsers enforce the same-origin policy, blocking cross-domain requests.

Limitations of .htaccess Configuration Method

Many developers first attempt to configure CORS headers through Apache's .htaccess file. A typical configuration looks like:

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ /index.php [QSA,L]
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Methods: "GET,POST,OPTIONS,DELETE,PUT"

However, this approach may encounter issues, especially when all requests are rewritten to index.php, where Apache's Header directive might not be properly applied.

PHP Code Implementation Solution

A more reliable solution involves handling CORS headers at the PHP level. The following code demonstrates a complete implementation:

// Allow requests from any origin
if (isset($_SERVER['HTTP_ORIGIN'])) {
    // Security checks should be added here to match $_SERVER['HTTP_ORIGIN'] against a whitelist of safe domains
    header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
    header('Access-Control-Allow-Credentials: true');
    header('Access-Control-Max-Age: 86400');    // Cache for 1 day
}
// Access-Control headers are received during OPTIONS requests
if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
    if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']))
        header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");         
    if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']))
        header("Access-Control-Allow-Headers: {$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']}");
}

Handling OPTIONS Requests in SLIM Framework

For applications using the SLIM framework, special handling of HTTP OPTIONS requests is required:

// Return HTTP 200 status code for HTTP OPTIONS requests
$app->map('/:x+', function($x) {
    http_response_code(200);
})->via('OPTIONS');

Security Considerations and Best Practices

In production environments, the wildcard "*" should not be used as the value for Access-Control-Allow-Origin. Implementing domain whitelist validation is recommended:

$allowed_origins = array('https://example.com', 'https://api.example.com');
if (in_array($_SERVER['HTTP_ORIGIN'], $allowed_origins)) {
    header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
}

Alternative Configuration Methods

If persisting with the .htaccess method, consider using add instead of set directives:

Header add Access-Control-Allow-Origin "*"
Header add Access-Control-Allow-Methods: "GET,POST,OPTIONS,DELETE,PUT"
Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"

Conclusion

Implementing CORS through PHP code provides more flexible and reliable control mechanisms, particularly when handling complex requests and preflight requests. Combined with SLIM framework's routing capabilities, developers can build secure and efficient cross-domain API services.