Nexus API Reference

OriginAllowlistMiddleware
in package
implements MiddlewareInterface

Read onlyYes
FinalYes
Tags
psalm-api

Rejects requests whose Origin header is not in an exact allow-list. The primary defense against cross-site WebSocket hijacking (CSWSH) and cookie-based CSRF: the browser attaches cookies to a cross-site WebSocket upgrade or form POST automatically, and neither has CORS preflight protection, so the server must verify the request came from an origin it trusts.

Matching is EXACT (scheme + host + port), never a substring or wildcard — https://app.example.com does not match https://app.example.com.evil.com or http://app.example.com. A request with no Origin header is allowed by default (non-browser clients, same-origin navigations that omit it) but this can be tightened with allowMissingOrigin: false for endpoints reachable only from browsers carrying cookie credentials.

Use it as WebSocket middleware (wsMiddleware(), so it runs in the pre-upgrade handshake) and on state-changing HTTP routes:

$app->wsMiddleware(new OriginAllowlistMiddleware(['https://app.example.com'])); $app->post('/transfer', TransferHandler::class) ->middleware(new OriginAllowlistMiddleware(['https://app.example.com']));

Pair cookie bearer tokens with SameSite=Strict/Lax and this check; a CSRF token remains advisable for defense in depth.

Table of Contents

Interfaces

MiddlewareInterface

Methods

__construct()  : mixed
process()  : ResponseInterface

Methods

__construct()

public __construct(array<int, string> $allowedOrigins[, bool $allowMissingOrigin = true ][, array<int, string> $safeMethods = [] ][, ResponseFactoryInterface|null $responseFactory = null ]) : mixed
Parameters
$allowedOrigins : array<int, string>

Exact origins (scheme://host[:port]) to accept.

$allowMissingOrigin : bool = true

When true (default), a request with no Origin header passes; set false to require an allowed Origin on every request.

$safeMethods : array<int, string> = []

HTTP methods exempt from the check (safe, non-state-changing). WebSocket upgrades arrive as GET, so GET is NOT exempt by default — the check applies to upgrades and to unsafe methods.

$responseFactory : ResponseFactoryInterface|null = null

process()

public process(ServerRequestInterface $request, RequestHandlerInterface $handler) : ResponseInterface
Parameters
$request : ServerRequestInterface
$handler : RequestHandlerInterface
Attributes
#[Override]
Return values
ResponseInterface
On this page

Search results