NelmioCorsBundle

NelmioCorsBundle is a Symfony bundle that adds Cross-Origin Resource Sharing (CORS) headers to your application’s responses using ACL-style, per-URL configuration. It handles CORS preflight OPTIONS requests and lets you control allowed origins, methods, headers, and credentials on a path-by-path basis.

Configured entirely at the PHP/application level through the standard Symfony configuration system, it gives API developers fine-grained control over which browsers and origins may call which endpoints, without touching web-server configuration.

What You Get

• Automatic handling of CORS preflight OPTIONS requests
• Per-URL, ACL-style configuration of allowed origins, methods, and headers
• Control over exposed headers, max-age caching, and credential support
• Pure application-level setup through Symfony configuration, with no web-server changes

Common Use Cases

• Allowing a browser-based frontend on another domain to call a Symfony API
• Applying different CORS policies to public and private API paths
• Enabling credentialed cross-origin requests for authenticated API clients

Under The Hood

Architecture - The bundle registers event listeners (in EventListener/) on Symfony’s kernel request and response events. On a preflight OPTIONS request it short-circuits with the computed headers; on normal requests it resolves the matching per-path options (from Options/) and appends the CORS headers to the response. Configuration is wired through DependencyInjection/.

Tech Stack - It is a lightweight PHP Symfony bundle (type symfony-bundle) with a minimal dependency footprint: symfony/framework-bundle and psr/log. It targets modern Symfony versions and uses PHPStan for static analysis.

Code Quality - The codebase is small and focused, with a PHPUnit test suite under Tests/, a phpstan.neon.dist configuration, and a documented SECURITY policy and CHANGELOG, reflecting a mature and stable project.

API Design - Everything is driven by declarative YAML/PHP configuration keyed by URL patterns, so developers express CORS policy as data rather than code. This makes it easy to reason about which origins are allowed where, at the cost of the noted limitation that requests bypassing Symfony (such as static files) are not covered.