PHP somo la 81: Cross - Orgn Resource Sharing - CORSE header

CORSE header:

CORS ni kifupisho cha maneno (Cross - Orgn Resource Sharing) hii ni miongoni mwa header ambazo zina nafasi kubwa sana katika usalama wa API. yenyewe ina kazi ya kuthibiti ni nani ana haki ya kupata response kutoka kwenye server. Kwa ufupi ni kuwa CORS inweza kuangalia origini ama asili ya request. Sasa kama hiyo request imefanywa nje ya website husika CORSE header inaweza kuzuia response ama kuruusu kulingana na condition ziizowekwa.

Mfano mzuri nina App ambayo inatumia data kutoka kwenye website yangu. Sasa kwanza nnaweza kucheki je hiyo request imetoka kwenlikwenye hiyo app. Kama haijatokka huk basi CORS itawez akuzuia.

Aina za CORS header:

1. Access-Control-Allow-Origin

Hii inatumia value ya (*) na kazi yake ni kuruhusu request kutoka popote pale.ata programmng alama hii huitwa wildcard endapo itatumika kuruhusu kila kitu bila ya kubaguwa. Hata hivyo jina lake hiyo nyota huitwa asteric kwa matumizi ya kawaid.. Ina maana request hapa haiangaliwi imetoka wapi, bila ya kujali response itapatikana.

Mfano:

header('Access-Control-Allow-Origin: *');

Na ama unataa uruhusu utoa wneye source maalumu mfano webste bas taubd utuma server variable l upata hyo doman.

Mfano:

header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");

2. Access-Control-Allow-Methods

Hii yenyewe inakwenda kuangalia kama method ndio inayotakiwa. Mfano kama request inatakiwa iwe kwa GET na ikaja kwa Post hivyo hapa itakataliwa.

Mfano:

Access-Control-Allow-Methods: GET, POST, PUT, DELETE

Hapo juu request taruhusu method zote hzo. Ama unataa mojawapo utawea hyo tu.

header("Access-Control-Allow-Methods: GET"); 

3. Access-Control-Allow-Headers

H yenyewe nawenda uzua header flan ama uruhusu. Mfanounaweza uzua ama request hana authorzaton header ama tulvyojfunzasomo lllopta. Kama zikiwa nyingi utazitenganisha kwa alama ya koma (,)

Mfano:

header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With"); 

Ama kama unataka kuruhusu zote utatumia alama ya nyota (*) yaani wildcard ili kuruhusu header zite

Mfano:

header("Access-Control-Allow-Headers: *"); 

4. Access-Control-Allow-Credentials

Hii yenyewe inakwenda kuangalia kama taarifa ambazo zinatumwa kwenye header ni sahihi kuweza kurionyesha ana haitakiwi. Ikiwa ni true ina maana hazitakiwi ionyeshwe.

Mfano:

header(“Access-Control-Allow-Credentials: true”);

5. Access-Control-Max-Age

Hii hutumika kuset ni kwa muda gani request inaweza kuwa kwenye cache. Tulishajifunza kwenye somo la cache.

Mfano:

header(“Access-Control-Max-Age: 86400”)

6. Access-Control-Expose-Headers

Hii huset kama header information ni salama kutumiwa na API ama sio salama. Hii hapa itaruhusu API kuweza kutumia baadhi tu ya header unazotaka itumie na usizotaka hutoziweka.

Mfano:

header(“Access-Control-Expose-Headers: Content-Length, X-Kuma-Revision”)

Mfano zaid:

<?php

// Allow from any origin

if (isset($_SERVER['HTTP_ORIGIN'])) {

    header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");

    header('Access-Control-Allow-Credentials: true');

    header('Access-Control-Max-Age: 86400'); // Cache for 1 day

}

// Access-Control headers are received during OPTIONS requests

if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {

    if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) {

        // Allow only specific methods

        header("Access-Control-Allow-Methods: GET, POST, OPTIONS"); 

    }

    if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'])) {

        // Allow only specific headers

        header("Access-Control-Allow-Headers: {$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']}"); 

    }

    exit(0);

}

// Your actual content follows

echo "CORS is handled.";

?>