Summary
Add a small, self-contained CORS middleware class in src/Middleware/CorsMiddleware.php (~50-60 lines).
Features
- Configurable allowed origins via
Configure::read('Cors')
Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-HeadersOPTIONS preflight handling with early 200 returnAccess-Control-Max-Age for preflight caching- Sensible defaults: allow
* in development, require explicit origin in production
Motivation
CORS is essential for any API consumed by browser-based clients. No external dependency needed -- a minimal built-in class keeps the skeleton self-contained.
Summary
Add a small, self-contained CORS middleware class in
src/Middleware/CorsMiddleware.php(~50-60 lines).Features
Configure::read('Cors')Access-Control-Allow-Methods,Access-Control-Allow-Headers,Access-Control-Expose-HeadersOPTIONSpreflight handling with early 200 returnAccess-Control-Max-Agefor preflight caching*in development, require explicit origin in productionMotivation
CORS is essential for any API consumed by browser-based clients. No external dependency needed -- a minimal built-in class keeps the skeleton self-contained.