br-cors-public-client

better-route: CORS and preflight

Define an explicit origin policy and attach it before declaring the routes that should inherit it.

use BetterRoute\Middleware\Cors\CorsMiddleware;
use BetterRoute\Middleware\Cors\CorsPolicy;

$cors = new CorsMiddleware(new CorsPolicy(
    allowedOrigins: ['https://app.example.com'],
    allowedMethods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],
    allowCredentials: true,
    maxAgeSeconds: 600,
));

$router->middleware([$cors]);

$router->get('/catalog', $catalog)->publicRoute();
$router->patch('/account', $update)
    ->protectedByMiddleware('cookieNonce')
    ->middleware([$cookieNonce]);

$router->options('/account', static fn () => null)
    ->publicRoute();

Router middleware is captured when each route is declared. Add global/group CORS before declaring those routes, or attach it per route.

1.1 WordPress bridge

CorsMiddleware implements WordPressRouteMiddlewareInterface. During Router::register(), every matched route is registered with WordPressCorsBridge.

The bridge:

• answers a matched preflight on rest_pre_dispatch before the normal route callback/middleware auth flow;
• returns 204 for allowed preflight;
• returns 403 cors_origin_denied for a disallowed origin when rejection is enabled;
• removes WordPress core CORS headers for matched routes and emits the configured policy on rest_pre_serve_request;
• preserves unrelated Vary tokens while managing Vary: Origin.

This prevents WordPress core from broadening or contradicting the application allowlist. It affects only registered Better Route paths carrying this middleware.

Every raw route denies by default in 1.1. If an explicit Router::options() route is needed, call publicRoute() or another deliberate permission method. Keep business logic out of preflight handlers.

Defaults

Default allowed request headers include:

• Authorization
• Content-Type
• Idempotency-Key
• If-Match
• If-None-Match
• X-Request-ID
• X-WP-Nonce