Class Nexus\Mcp\Server\Transport\Http\Middleware\CorsMiddleware

`final`
`readonly`
`implements`	`MiddlewareInterface`

Grants browser clients cross-origin access to the MCP endpoint. The middleware is additive. An allowed Origin is reflected into Access-Control-Allow-Origin, a preflight OPTIONS is answered with 204 plus the negotiated Access-Control-* headers, and every other request is forwarded and its response decorated. A disallowed or absent Origin receives no grant, so rejection stays with the DNS-rebinding gate. Every response carries the Vary keys it turns on, grant or not, so a shared cache cannot serve one origin's answer to another.

Located at Server/Transport/Http/Middleware/CorsMiddleware.php

Methods


					
	public

__construct(list<non-empty-string> $allowedOrigins, ResponseFactoryInterface $responseFactory, int $maxAge = 600)

Parameters

`$allowedOrigins`	Origins granted cross-origin access, or `['*']` to allow any
`$maxAge`	Seconds a browser may cache the preflight result


					
	public

process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface

Namespaces

Classes

Class Nexus\Mcp\Server\Transport\Http\Middleware\CorsMiddleware

Parameters