クラス yii\filters\Cors

                public function addCorsHeaders($response, $headers)
{
    if (empty($headers) === false) {
        $responseHeaders = $response->getHeaders();
        foreach ($headers as $field => $value) {
            $responseHeaders->set($field, $value);
        }
    }
}

            

                public function beforeAction($action)
{
    $this->request = $this->request ?: Yii::$app->getRequest();
    $this->response = $this->response ?: Yii::$app->getResponse();
    $this->overrideDefaultSettings($action);
    $requestCorsHeaders = $this->extractHeaders();
    $responseCorsHeaders = $this->prepareHeaders($requestCorsHeaders);
    $this->addCorsHeaders($this->response, $responseCorsHeaders);
    if ($this->request->isOptions && $this->request->headers->has('Access-Control-Request-Method')) {
        // it is CORS preflight request, respond with 200 OK without further processing
        $this->response->setStatusCode(200);
        return false;
    }
    return true;
}

            

                public function extractHeaders()
{
    $headers = [];
    foreach (array_keys($this->cors) as $headerField) {
        $serverField = $this->headerizeToPhp($headerField);
        $headerData = isset($_SERVER[$serverField]) ? $_SERVER[$serverField] : null;
        if ($headerData !== null) {
            $headers[$headerField] = $headerData;
        }
    }
    return $headers;
}

            

                protected function headerize($string)
{
    $headers = preg_split('/[\\s,]+/', $string, -1, PREG_SPLIT_NO_EMPTY);
    $headers = array_map(function ($element) {
        return str_replace(' ', '-', ucwords(strtolower(str_replace(['_', '-'], [' ', ' '], $element))));
    }, $headers);
    return implode(', ', $headers);
}

            

                protected function headerizeToPhp($string)
{
    return 'HTTP_' . strtoupper(str_replace([' ', '-'], ['_', '_'], $string));
}

            

                public function overrideDefaultSettings($action)
{
    if (isset($this->actions[$action->id])) {
        $actionParams = $this->actions[$action->id];
        $actionParamsKeys = array_keys($actionParams);
        foreach ($this->cors as $headerField => $headerValue) {
            if (in_array($headerField, $actionParamsKeys)) {
                $this->cors[$headerField] = $actionParams[$headerField];
            }
        }
    }
}

            

                protected function prepareAllowHeaders($type, $requestHeaders, &$responseHeaders)
{
    $requestHeaderField = 'Access-Control-Request-' . $type;
    $responseHeaderField = 'Access-Control-Allow-' . $type;
    if (!isset($requestHeaders[$requestHeaderField], $this->cors[$requestHeaderField])) {
        return;
    }
    if (in_array('*', $this->cors[$requestHeaderField])) {
        $responseHeaders[$responseHeaderField] = $this->headerize($requestHeaders[$requestHeaderField]);
    } else {
        $requestedData = preg_split('/[\\s,]+/', $requestHeaders[$requestHeaderField], -1, PREG_SPLIT_NO_EMPTY);
        $acceptedData = array_uintersect($requestedData, $this->cors[$requestHeaderField], 'strcasecmp');
        if (!empty($acceptedData)) {
            $responseHeaders[$responseHeaderField] = implode(', ', $acceptedData);
        }
    }
}

            

                public function prepareHeaders($requestHeaders)
{
    $responseHeaders = [];
    // handle Origin
    if (isset($requestHeaders['Origin'], $this->cors['Origin'])) {
        if (in_array($requestHeaders['Origin'], $this->cors['Origin'], true)) {
            $responseHeaders['Access-Control-Allow-Origin'] = $requestHeaders['Origin'];
        }
        if (in_array('*', $this->cors['Origin'], true)) {
            // Per CORS standard (https://fetch.spec.whatwg.org), wildcard origins shouldn't be used together with credentials
            if (isset($this->cors['Access-Control-Allow-Credentials']) && $this->cors['Access-Control-Allow-Credentials']) {
                if (YII_DEBUG) {
                    throw new InvalidConfigException("Allowing credentials for wildcard origins is insecure. Please specify more restrictive origins or set 'credentials' to false in your CORS configuration.");
                } else {
                    Yii::error("Allowing credentials for wildcard origins is insecure. Please specify more restrictive origins or set 'credentials' to false in your CORS configuration.", __METHOD__);
                }
            } else {
                $responseHeaders['Access-Control-Allow-Origin'] = '*';
            }
        }
    }
    $this->prepareAllowHeaders('Headers', $requestHeaders, $responseHeaders);
    if (isset($requestHeaders['Access-Control-Request-Method'])) {
        $responseHeaders['Access-Control-Allow-Methods'] = implode(', ', $this->cors['Access-Control-Request-Method']);
    }
    if (isset($this->cors['Access-Control-Allow-Credentials'])) {
        $responseHeaders['Access-Control-Allow-Credentials'] = $this->cors['Access-Control-Allow-Credentials'] ? 'true' : 'false';
    }
    if (isset($this->cors['Access-Control-Max-Age']) && $this->request->getIsOptions()) {
        $responseHeaders['Access-Control-Max-Age'] = $this->cors['Access-Control-Max-Age'];
    }
    if (isset($this->cors['Access-Control-Expose-Headers'])) {
        $responseHeaders['Access-Control-Expose-Headers'] = implode(', ', $this->cors['Access-Control-Expose-Headers']);
    }
    if (isset($this->cors['Access-Control-Allow-Headers'])) {
        $responseHeaders['Access-Control-Allow-Headers'] = implode(', ', $this->cors['Access-Control-Allow-Headers']);
    }
    return $responseHeaders;
}