Cleanup

src/config/GeneralConfig.php

@@ -203,7 +203,7 @@ class GeneralConfig extends BaseConfig
      *
      * @group GraphQL
      * @since 3.5.0
-     * @deprecated in 4.11.0 Use \craft\filters\Cors::class instead.
+     * @deprecated in 4.11.0. [[\craft\filters\Cors]] should be used instead.
      * @see https://www.yiiframework.com/doc/api/2.0/yii-filters-cors
      */
     public array|null|false $allowedGraphqlOrigins = null;
@@ -1977,7 +1977,7 @@ class GeneralConfig extends BaseConfig
      *
      * @group System
      * @since 3.6.14
-     * @deprecated in 4.11.0 Use \craft\filters\Headers::class instead
+     * @deprecated in 4.11.0. [[\craft\filters\Headers]] should be used instead.
      */
     public ?string $permissionsPolicyHeader = null;
 
@@ -3472,7 +3472,7 @@ public function allowAdminChanges(bool $value = true): self
      * @return self
      * @see $allowedGraphqlOrigins
      * @since 4.2.0
-     * @deprecated in 4.11.0 Use \craft\filters\Cors::class instead
+     * @deprecated in 4.11.0. [[\craft\filters\Cors]] should be used instead.
      * @see https://www.yiiframework.com/doc/api/2.0/yii-filters-cors
      */
     public function allowedGraphqlOrigins(array|null|false $value): self
@@ -5370,7 +5370,7 @@ public function pathParam(?string $value): self
      * @return self
      * @see $permissionsPolicyHeader
      * @since 4.2.0
-     * @deprecated in 4.11.0 Use \craft\filters\Headers::class instead.
+     * @deprecated in 4.11.0. [[\craft\filters\Headers]] should be used instead.
      */
     public function permissionsPolicyHeader(?string $value): self
     {

src/filters/Headers.php

@@ -8,23 +8,30 @@
 namespace craft\filters;
 
 use Craft;
+use yii\base\ActionFilter;
 
 /**
  * Filter for adding arbitrary headers to site responses and handling OPTIONS requests.
  *
  * @author Pixel & Tonic, Inc. <[email protected]>
  * @since 4.11.0
  */
-class Headers extends \yii\base\ActionFilter
+class Headers extends ActionFilter
 {
     use SiteFilterTrait;
 
+    /**
+     * @var array<string,string|string[]> The headers that should be set on responses.
+     */
     public array $headers = [];
 
     public function beforeAction($action): bool
     {
-        foreach ($this->headers as $name => $value) {
-            Craft::$app->getResponse()->getHeaders()->set($name, $value);
+        if (!empty($this->headers)) {
+            $responseHeaders = Craft::$app->getResponse()->getHeaders();
+            foreach ($this->headers as $name => $value) {
+                $responseHeaders->set($name, $value);
+            }
         }
 
         return true;

src/filters/SiteFilterTrait.php

@@ -14,6 +14,7 @@
 /**
  * Trait to make a filter site-aware.
  *
+ * @property-write int|string|Site|array<int|string|Site> $site
  * @see https://www.yiiframework.com/doc/api/2.0/yii-filters-cors
  * @author Pixel & Tonic, Inc. <[email protected]>
  * @since 4.11.0
@@ -24,11 +25,11 @@ trait SiteFilterTrait
 
     protected function isActive(mixed $action): bool
     {
-        if (Craft::$app->getRequest()->isCpRequest || !$this->isCurrentSiteActive()) {
+        if (!parent::isActive($action)) {
             return false;
         }
 
-        return parent::isActive($action);
+        return !$this->isCurrentSiteActive();
     }
 
     protected function setSite(null|array|int|string|Site $value): void
@@ -59,6 +60,10 @@ private function getSiteId(int|string|Site $value): int
 
     private function isCurrentSiteActive(): bool
     {
+        if (!Craft::$app->getRequest()->getIsSiteRequest()) {
+            return false;
+        }
+
         return $this->siteIds === null || in_array(Craft::$app->getSites()->getCurrentSite()->id, $this->siteIds, true);
     }
 }

src/web/Application.php

@@ -640,8 +640,8 @@ private function _processActionRequest(Request $request): ?BaseResponse
 
                 // Return the response for OPTIONS requests that return null
                 // to support the CORS filter: https://www.yiiframework.com/doc/api/2.0/yii-filters-cors
-                return $response === null && $this->getRequest()->getIsOptions()
-                    ? $this->getResponse()
+                return $request->getIsOptions()
+                    ? ($response ?? $this->getResponse())
                     : $response;
             } catch (Throwable $e) {
                 $this->_unregisterDebugModule();