Expand description
Cross-Origin Resource Sharing.
A browser will not let a page on one origin read a response from another
unless the response says so. Without this middleware an API works from
curl, from a mobile app, and from a server — and fails, silently, from
every single-page application that is not served from the same host.
The shape follows Laravel’s config/cors.php, key for key, so a person who
has configured CORS there already knows how to configure it here:
App::new()?.middleware(Cors::from_config(app.config()))
// or, in code:
App::new()?.middleware(
Cors::new()
.allow_origins(["https://app.example.com"])
.allow_credentials(),
)Two things are worth knowing before reaching for Cors::permissive. A
wildcard origin cannot be combined with credentials — the specification
forbids Access-Control-Allow-Origin: * on a response that also allows
cookies — so with credentials on, this echoes the requesting origin instead,
which allows every origin to make credentialled requests. That is rarely
what anyone means. Name the origins.