@@ -155,26 +155,36 @@ public function provideAllowedFormRequests(): array {
155155 [['CONTENT_TYPE ' => 'multipart/form-data ' ]],
156156 // The custom Apollo-Require-Preflight header overrules any evil Origin
157157 // header.
158- [[
159- 'CONTENT_TYPE ' => 'multipart/form-data ' ,
160- 'HTTP_APOLLO_REQUIRE_PREFLIGHT ' => 'test ' ,
161- 'HTTP_ORIGIN ' => 'https://evil.example.com ' ,
162- ]],
158+ [
159+ [
160+ 'CONTENT_TYPE ' => 'multipart/form-data ' ,
161+ 'HTTP_APOLLO_REQUIRE_PREFLIGHT ' => 'test ' ,
162+ 'HTTP_ORIGIN ' => 'https://evil.example.com ' ,
163+ ],
164+ ],
163165 // The Origin header alone with the correct domain is allowed.
164- [[
165- 'CONTENT_TYPE ' => 'multipart/form-data ' ,
166- 'HTTP_ORIGIN ' => 'https://example.com ' ,
167- ]],
166+ [
167+ [
168+ 'CONTENT_TYPE ' => 'multipart/form-data ' ,
169+ 'HTTP_ORIGIN ' => 'https://example.com ' ,
170+ ],
171+ ],
168172 // The Origin header with an allowed domain.
169- [[
170- 'CONTENT_TYPE ' => 'multipart/form-data ' ,
171- 'HTTP_ORIGIN ' => 'https://allowed.example.com ' ,
172- ], ['https://allowed.example.com ' ]],
173+ [
174+ [
175+ 'CONTENT_TYPE ' => 'multipart/form-data ' ,
176+ 'HTTP_ORIGIN ' => 'https://allowed.example.com ' ,
177+ ],
178+ ['https://allowed.example.com ' ],
179+ ],
173180 // The Origin header with any allowed domain.
174- [[
175- 'CONTENT_TYPE ' => 'multipart/form-data ' ,
176- 'HTTP_ORIGIN ' => 'https://allowed.example.com ' ,
177- ], ['* ' ]],
181+ [
182+ [
183+ 'CONTENT_TYPE ' => 'multipart/form-data ' ,
184+ 'HTTP_ORIGIN ' => 'https://allowed.example.com ' ,
185+ ],
186+ ['* ' ],
187+ ],
178188 ];
179189 }
180190
0 commit comments