Add CORS listener

Resources/config/services/security.xml

@@ -12,6 +12,11 @@
     </parameters>
 
     <services>
+        <service id="fulll.cors_listener" class="Rezzza\SecurityBundle\Listener\CorsListener" public="false">
+            <argument type="service" id="logger" on-invalid="null" />
+            <tag name="kernel.event_listener" event="kernel.request" method="onKernelRequest" priority="200" />
+        </service>
+
         <service id="fulll.request_signature.provider" class="Rezzza\SecurityBundle\Security\Firewall\RequestSignatureProdiver" />
 
         <service id="rezzza.security.request_signature.listener" class="%rezzza.security.request_signature.listener.class%" public="false">

Security/Listener/CorsSecurityListener.php

@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Security\Listener;
+
+use Nelmio\CorsBundle\EventListener\CorsListener;
+use Psr\Log\LoggerInterface;
+use Psr\Log\NullLogger;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
+
+/**
+ * Deny request if Origin header is set and nelmio/cors-bundle has rejected it.
+ */
+class CorsSecurityListener
+{
+    private LoggerInterface|NullLogger $logger;
+
+    public function __construct(
+        ?LoggerInterface $logger,
+    ) {
+        if (null === $logger) {
+            $logger = new NullLogger();
+        }
+
+        $this->logger = $logger;
+    }
+
+    public function onKernelRequest(RequestEvent $event): void
+    {
+        if (HttpKernelInterface::MAIN_REQUEST !== $event->getRequestType()) {
+            $this->logger->debug('Not a master type request, skipping CORS validation.');
+
+            return;
+        }
+
+        $request = $event->getRequest();
+
+        // CORS preflight request was already handled by NelmioCorsBundle
+        if ('OPTIONS' === $request->getMethod()) {
+            return;
+        }
+
+        // If the request has an Origin header and the CORS listener has not validated it, deny the request
+        if (
+            $request->headers->has('Origin')
+            && !$request->attributes->has(CorsListener::SHOULD_ALLOW_ORIGIN_ATTR)
+        ) {
+            $this->logger->debug('CORS validation failed, denying request.');
+
+            $response = new Response('Origin CORS denied', Response::HTTP_BAD_REQUEST);
+            $event->setResponse($response);
+        }
+    }
+}

composer.json

@@ -13,7 +13,8 @@
         "php": ">=8.0",
         "symfony/framework-bundle": ">=5.4",
         "symfony/security-bundle" : ">=5.4",
-        "doctrine/common": "~2.2|~3.0"
+        "doctrine/common": "~2.2|~3.0",
+        "nelmio/cors-bundle": "~2.5"
     },
     "require-dev": {
         "atoum/atoum": "~4.0",