Hi there!

Thank you for the contrib.

But I have a question: does it really make sense to expose all the headers by default in such case?
I mean, I have the feeling that in such case those headers would have been sent by the backend, this means the backend can also define Access-Control-Expose-Headers and with more granularity.

I never encounter any scenario where this has been required, my opinion might be biased so calling some friends on this (wdyt @Kocal @smnandre @nicolas-grekas @stof ?).

Reminder: the CORS safe headers headers are exposed by default so this change would expose all the headers for CORS responses.

@tucksaun If Symfony server stays for local development so yes this facility makes sense IMO the same way the server allows all http verbs and all origins.

Some applications need to send custom headers to the client, and in this context javascript needs to access those response headers.

In production hosted environments, it is not the same context. Symfony server should not be used. And if there is CORS need, granularity should be defined in exposed headers as well as http verbs and allowed origins for security reasons.

Some applications need to send custom headers to the client, and in this context javascript needs to access those response headers.

Yes I agree but if you send custom headers, this is done in the backend code and as such one can control the CORS headers. The --allow-cors option is really meant to be used for static assets which usually do not need custom headers access.

Yes I agree but if you send custom headers, this is done in the backend code and as such one can control the CORS headers.

Backend code is not meant to deal with development environment. It is not part of the application nor the production environment unfortunately. 😞

I am working on an application where front and back are in the same domain. No CORS issue.
Using traefik for example in dev env with same host could resolve it. No code.
If I choose to use symfony server (localhost:8000) and npm start (localhost:3000), I need to enable cors to make it work.

The --allow-cors option is really meant to be used for static assets which usually do not need custom headers access.

Indeed. True for static assets.
But if it is really meant to be used for assets, why exposing all HTTP verbs? Same for headers in response to prefilghts requests. 🤔

I have no strong opinions on this, and I'm far from being a CORS expert, but since Symfony CLI should only be used for dev purpose, I think it's fine here (and so, even if the backend code could add the header too)