Fix CORS Error in Laravel

Updated April 2026

Laravel 7+ ships with built-in CORS support. No package needed. Configure it in config/cors.php and the framework handles OPTIONS preflight automatically.

Laravel 7+ — built-in CORS (no package needed)

# Publish the CORS config if it does not exist
php artisan config:publish cors

# config/cors.php
return [ 'paths' => ['api/*', 'sanctum/csrf-cookie'], 'allowed_methods' => ['*'], 'allowed_origins' => ['https://yourapp.com'], 'allowed_origins_patterns' => [], 'allowed_headers' => ['*'], 'exposed_headers' => [], 'max_age' => 0, 'supports_credentials' => false,  // set true if using cookies
];

The HandleCors middleware is automatically registered globally in Laravel 7+. You do not need to add it to any middleware group — editing config/cors.php is sufficient.

Laravel Sanctum — SPA authentication with cookies

# config/cors.php
return [ 'paths' => ['api/*', 'sanctum/csrf-cookie'], 'allowed_origins' => ['https://yourapp.com'], 'supports_credentials' => true,  // required for Sanctum cookie auth 'allowed_methods' => ['*'], 'allowed_headers' => ['*'],
];

# Also set in .env or config/session.php:
SESSION_DOMAIN=.yourapp.com
SANCTUM_STATEFUL_DOMAINS=yourapp.com

Laravel 6 and below — fruitcake/laravel-cors

composer require fruitcake/laravel-cors

# app/Http/Kernel.php — add to $middleware
protected $middleware = [ \Fruitcake\Cors\HandleCors::class, // ...
];

API-only routes with Passport or JWT

# config/cors.php
'paths' => ['api/*'],
'allowed_headers' => ['Content-Type', 'Authorization', 'X-Requested-With'],
'allowed_methods' => ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
'allowed_origins' => ['https://yourapp.com'],
'supports_credentials' => false, // JWT is stateless, no cookies needed

Clear config cache after changes

php artisan config:clear
php artisan config:cache