Based on https://github.com/asm89/stack-cors
The laravel-cors
package allows you to send Cross-Origin Resource Sharing
headers with Laravel middleware configuration.
If you want to have have a global overview of CORS workflow, you can browse this image.
- Handles CORS pre-flight OPTIONS requests
- Adds CORS headers to your responses
Require the barryvdh/laravel-cors
package in your composer.json
and update your dependencies:
$ composer require barryvdh/laravel-cors
Add the Cors\ServiceProvider to your config/app.php
providers array:
Barryvdh\Cors\ServiceProvider::class,
To allow CORS for all your routes, add the HandleCors
middleware in the $middleware
property of app/Http/Kernel.php
class:
protected $middleware = [
// ...
\Barryvdh\Cors\HandleCors::class,
];
If you want to allow CORS on a specific middleware group or route, add the HandleCors
middleware to your group:
protected $middlewareGroups = [
'web' => [
// ...
],
'api' => [
// ...
\Barryvdh\Cors\HandleCors::class,
],
];
The defaults are set in config/cors.php
. Copy this file to your own config directory to modify the values. You can publish the config using this command:
$ php artisan vendor:publish --provider="Barryvdh\Cors\ServiceProvider"
Note: When using custom headers, like
X-Auth-Token
orX-Requested-With
, you must set theallowedHeaders
to include those headers. You can also set it toarray('*')
to allow all custom headers.
Note: If you are explicitly whitelisting headers, you must include
Origin
or requests will fail to be recognized as CORS.
return [
/*
|--------------------------------------------------------------------------
| Laravel CORS
|--------------------------------------------------------------------------
|
| allowedOrigins, allowedHeaders and allowedMethods can be set to array('*')
| to accept any value.
|
*/
'supportsCredentials' => false,
'allowedOrigins' => ['*'],
'allowedHeaders' => ['Content-Type', 'X-Requested-With'],
'allowedMethods' => ['*'], // ex: ['GET', 'POST', 'PUT', 'DELETE']
'exposedHeaders' => [],
'maxAge' => 0,
]
allowedOrigins
, allowedHeaders
and allowedMethods
can be set to array('*')
to accept any value.
Note: Try to be a specific as possible. You can start developing with loose constraints, but it's better to be as strict as possible!
Note: Because of http method overriding in Laravel, allowing POST methods will also enable the API users to perform PUT and DELETE requests as well.
On Laravel Lumen, load your configuration file manually in bootstrap/app.php
:
$app->configure('cors');
And register the ServiceProvider:
$app->register(Barryvdh\Cors\ServiceProvider::class);
To allow CORS for all your routes, add the HandleCors
middleware to the global middleware:
$app->middleware([
// ...
\Barryvdh\Cors\HandleCors::class,
]);
If you want to allow CORS on a specific middleware group or route, add the HandleCors
middleware to your group:
$app->routeMiddleware([
// ...
'cors' => \Barryvdh\Cors\HandleCors::class,
]);
In order for the package to work, the request has to be a valid CORS request and needs to include an "Origin" header.
When an error occurs, the middleware isn't run completely. So when this happens, you won't see the actual result, but will get a CORS error instead.
This could be a CSRF token error or just a simple problem.
Note: This should be working in Laravel 5.3+.
If possible, use a different route group with CSRF protection enabled.
Otherwise you can disable CSRF for certain requests in App\Http\Middleware\VerifyCsrfToken
:
protected $except = [
'api/*'
];
Released under the MIT License, see LICENSE.