50 lines
2.0 KiB
Plaintext
50 lines
2.0 KiB
Plaintext
<?php
|
|
return [
|
|
'elixforms_api_base_url' => 'https://api.example.com',
|
|
|
|
'rate_limiter_driver' => 'file', // o 'memory'
|
|
// configuration for file-based rate limiter
|
|
'rate_limit_storage_dir' => sys_get_temp_dir() . '/api_rate_limit',
|
|
// configuration for memory-based rate limiter
|
|
'rate_limit_requests' => 100,
|
|
'rate_limit_window_seconds' => 60,
|
|
|
|
'cors' => [
|
|
'enabled' => true,
|
|
// Allowed origins - requests from other origins will be rejected
|
|
'allowed_origins' => [
|
|
'http://localhost:3000', // Local development - frontend
|
|
'http://localhost:8080', // Local development - alternative port
|
|
'https://app.example.com', // Production frontend
|
|
'https://admin.example.com', // Production admin panel
|
|
// 'http://localhost:*', // Allow any port on localhost (not recommended)
|
|
// '*' // Allow all origins (HIGHLY NOT RECOMMENDED for production)
|
|
],
|
|
// HTTP methods allowed for CORS requests
|
|
'allowed_methods' => ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
|
|
// HTTP headers allowed in the request
|
|
'allowed_headers' => [
|
|
'Content-Type',
|
|
'Authorization',
|
|
'X-Requested-With',
|
|
'Accept',
|
|
'Accept-Language',
|
|
'Content-Language',
|
|
'X-API-Key',
|
|
],
|
|
// HTTP headers exposed to the client
|
|
'exposed_headers' => [
|
|
'Content-Length',
|
|
'X-JSON-Response-Code',
|
|
'X-Rate-Limit-Limit',
|
|
'X-Rate-Limit-Remaining',
|
|
'X-Rate-Limit-Reset',
|
|
],
|
|
// Allow credentials (cookies, authorization headers) in cross-origin requests
|
|
// Only set to true if you understand the security implications
|
|
'allow_credentials' => false,
|
|
// How long (in seconds) the browser can cache the preflight response
|
|
'max_age' => 86400, // 24 hours
|
|
],
|
|
];
|