From bb76becf81ce76926d2bf88edf0e5ca511d6714b Mon Sep 17 00:00:00 2001
From: Damodar Lohani <dlohani48@gmail.com>
Date: Tue, 10 Feb 2026 10:52:53 +0000
Subject: [PATCH] Add CORS configuration and refactor CORS resource handling

---
 app/config/cors.php    | 53 +++++++++++++++++++++++++++++++++++++
 app/init/configs.php   |  1 +
 app/init/resources.php | 59 ++++++++----------------------------------
 3 files changed, 65 insertions(+), 48 deletions(-)
 create mode 100644 app/config/cors.php

diff --git a/app/config/cors.php b/app/config/cors.php
new file mode 100644
index 0000000000..ef1adeb998
--- /dev/null
+++ b/app/config/cors.php
@@ -0,0 +1,53 @@
+<?php
+
+/**
+ * CORS Configuration
+ *
+ * Centralised list of allowed methods, headers, and exposed headers for CORS responses.
+ */
+return [
+    'allowedMethods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
+    'allowedHeaders' => [
+        'Accept',
+        'Origin',
+        'Cookie',
+        'Set-Cookie',
+        // Content
+        'Content-Type',
+        'Content-Range',
+        // Appwrite
+        'X-Appwrite-Project',
+        'X-Appwrite-Key',
+        'X-Appwrite-Dev-Key',
+        'X-Appwrite-Locale',
+        'X-Appwrite-Mode',
+        'X-Appwrite-JWT',
+        'X-Appwrite-Response-Format',
+        'X-Appwrite-Timeout',
+        'X-Appwrite-ID',
+        'X-Appwrite-Timestamp',
+        'X-Appwrite-Session',
+        'X-Appwrite-Platform',
+        // SDK generator
+        'X-SDK-Version',
+        'X-SDK-Name',
+        'X-SDK-Language',
+        'X-SDK-Platform',
+        'X-SDK-GraphQL',
+        'X-SDK-Profile',
+        // Caching
+        'Range',
+        'Cache-Control',
+        'Expires',
+        'Pragma',
+        // Server to server
+        'X-Fallback-Cookies',
+        'X-Requested-With',
+        'X-Forwarded-For',
+        'X-Forwarded-User-Agent',
+    ],
+    'exposedHeaders' => [
+        'X-Appwrite-Session',
+        'X-Fallback-Cookies',
+    ],
+];
diff --git a/app/init/configs.php b/app/init/configs.php
index d5748707cf..35c8e3899d 100644
--- a/app/init/configs.php
+++ b/app/init/configs.php
@@ -46,3 +46,4 @@ Config::load('storage-outputs', __DIR__ . '/../config/storage/outputs.php', $con
 Config::load('specifications', __DIR__ . '/../config/specifications.php', $configAdapter);
 Config::load('templates-function', __DIR__ . '/../config/templates/function.php', $configAdapter);
 Config::load('templates-site', __DIR__ . '/../config/templates/site.php', $configAdapter);
+Config::load('cors', __DIR__ . '/../config/cors.php', $configAdapter);
diff --git a/app/init/resources.php b/app/init/resources.php
index 8f78df1573..792efce4f7 100644
--- a/app/init/resources.php
+++ b/app/init/resources.php
@@ -296,54 +296,17 @@ Http::setResource('rule', function (Request $request, Database $dbForPlatform, D
 /**
  * CORS service
  */
-Http::setResource('cors', fn (array $allowedHostnames) => new Cors(
-    $allowedHostnames,
-    allowedMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
-    allowedHeaders: [
-        'Accept',
-        'Origin',
-        'Cookie',
-        'Set-Cookie',
-        // Content
-        'Content-Type',
-        'Content-Range',
-        // Appwrite
-        'X-Appwrite-Project',
-        'X-Appwrite-Key',
-        'X-Appwrite-Dev-Key',
-        'X-Appwrite-Locale',
-        'X-Appwrite-Mode',
-        'X-Appwrite-JWT',
-        'X-Appwrite-Response-Format',
-        'X-Appwrite-Timeout',
-        'X-Appwrite-ID',
-        'X-Appwrite-Timestamp',
-        'X-Appwrite-Session',
-        'X-Appwrite-Platform', // for `$platform` injection and SDK generator
-        // SDK generator
-        'X-SDK-Version',
-        'X-SDK-Name',
-        'X-SDK-Language',
-        'X-SDK-Platform',
-        'X-SDK-GraphQL',
-        'X-SDK-Profile',
-        // Caching
-        'Range',
-        'Cache-Control',
-        'Expires',
-        'Pragma',
-        // Server to server
-        'X-Fallback-Cookies',
-        'X-Requested-With',
-        'X-Forwarded-For',
-        'X-Forwarded-User-Agent',
-    ],
-    allowCredentials: true,
-    exposedHeaders: [
-        'X-Appwrite-Session',
-        'X-Fallback-Cookies',
-    ],
-), ['allowedHostnames']);
+Http::setResource('cors', function (array $allowedHostnames) {
+    $corsConfig = Config::getParam('cors');
+
+    return new Cors(
+        $allowedHostnames,
+        allowedMethods: $corsConfig['allowedMethods'],
+        allowedHeaders: $corsConfig['allowedHeaders'],
+        allowCredentials: true,
+        exposedHeaders: $corsConfig['exposedHeaders'],
+    );
+}, ['allowedHostnames']);
 
 Http::setResource('originValidator', function (Document $devKey, array $allowedHostnames, array $allowedSchemes) {
     if (!$devKey->isEmpty()) {