Add configuration flag to allow to opt-out from skipping CORS when same as origin

DependencyInjection/Configuration.php

@@ -49,6 +49,7 @@ public function getConfigTreeBuilder(): TreeBuilder
                     ->append($this->getHosts())
                     ->append($this->getOriginRegex())
                     ->append($this->getForcedAllowOriginValue())
+                    ->append($this->getSkipSameAsOrigin())
                 ->end()
 
                 ->arrayNode('paths')
@@ -64,13 +65,22 @@ public function getConfigTreeBuilder(): TreeBuilder
                         ->append($this->getHosts())
                         ->append($this->getOriginRegex())
                         ->append($this->getForcedAllowOriginValue())
+                        ->append($this->getSkipSameAsOrigin())
                     ->end()
                 ->end()
             ;
 
         return $treeBuilder;
     }
 
+    private function getSkipSameAsOrigin(): BooleanNodeDefinition
+    {
+        $node = new BooleanNodeDefinition('skip_same_as_origin');
+        $node->defaultTrue();
+
+        return $node;
+    }
+
     private function getAllowCredentials(): BooleanNodeDefinition
     {
         $node = new BooleanNodeDefinition('allow_credentials');

EventListener/CorsListener.php

@@ -64,7 +64,11 @@ public function onKernelRequest(RequestEvent $event): void
         }
 
         // skip if not a CORS request
-        if (!$request->headers->has('Origin') || $request->headers->get('Origin') === $request->getSchemeAndHttpHost()) {
+        if (!$request->headers->has('Origin')) {
+            return;
+        }
+
+        if ($options['skip_same_as_origin'] && $request->headers->get('Origin') === $request->getSchemeAndHttpHost()) {
             return;
         }
 

README.md

@@ -70,6 +70,7 @@ seconds.
             hosts: []
             origin_regex: false
             forced_allow_origin_value: ~
+            skip_same_as_origin: true
         paths:
             '^/api/':
                 allow_origin: ['*']