fix Access-Control-Expose-Headers

ozee31 · Dec 21, 2018 · 0cf7ee0 · 0cf7ee0
1 parent 68ad815
commit 0cf7ee0
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/src/Routing/Middleware/CorsMiddleware.php b/src/Routing/Middleware/CorsMiddleware.php
@@ -17,12 +17,14 @@ public function __invoke(ServerRequestInterface $request, ResponseInterface $res
                 ->withHeader('Access-Control-Allow-Origin', $this->_allowOrigin($request))
                 ->withHeader('Access-Control-Allow-Credentials', $this->_allowCredentials())
                 ->withHeader('Access-Control-Max-Age', $this->_maxAge())
-                ->withHeader('Access-Control-Allow-Headers', $this->_allowHeaders($request))
-                ->withHeader('Access-Control-Allow-Methods', $this->_allowMethods())
-                ->withHeader('Access-Control-Expose-Headers', $this->_exposeHeaders());
+                ->withHeader('Access-Control-Expose-Headers', $this->_exposeHeaders())
             ;
 
             if (strtoupper($request->getMethod()) === 'OPTIONS') {
+                $response = $response
+                    ->withHeader('Access-Control-Allow-Headers', $this->_allowHeaders($request))
+                    ->withHeader('Access-Control-Allow-Methods', $this->_allowMethods())
+                ;
                 return $response;
             }
         }