title: Laravel API cors - request header field authorization is not allowed by Access-Control-Allow-Headers in preflight response
body: <p>I'm having a CORS issue between my Laravel api and Angular client application.</p>
  
  <p>This is my cors middleware</p>
  
  <pre><code>public function handle($request, Closure $next)
      {
          return $next($request)
              -&gt;header('Access-Control-Allow-Origin', 'http://localhost:4200')
              -&gt;header('Access-Control-Allow-Credentials', 'true')
              -&gt;header('Access-Control-Allow-Methods', 'GET,HEAD,OPTIONS,POST,PUT"')
              -&gt;header('Access-Control-Allow-Headers', 'Origin, Content-Type');        }
  }
  </code></pre>
  
  <p>I'm getting the following error </p>
  
  <blockquote>
    <p>Access to XMLHttpRequest at '<a href="http://127.0.0.1:8000/api/advertisement/31/upload-image" rel="nofollow noreferrer">http://127.0.0.1:8000/api/advertisement/31/upload-image</a>' from origin '<a href="http://localhost:4200" rel="nofollow noreferrer">http://localhost:4200</a>' has been blocked by CORS policy: Request header field authorization is not allowed by Access-Control-Allow-Headers in preflight response.</p>
  </blockquote>
  
  <p>The Network response gives me a 200 response code. So I'll post the headers I get.</p>
  
  <p><a href="https://i.stack.imgur.com/VZq93.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VZq93.png" alt="Network Img"></a></p>
  
  <p>Angular is on localhost:4200
  Laravel is on 127.0.0.1:8000</p>
  
  <p>bootstrap/app.php</p>
  
  <pre><code>&lt;?php
  
  /*
  |--------------------------------------------------------------------------
  | Create The Application
  |--------------------------------------------------------------------------
  |
  | The first thing we will do is create a new Laravel application instance
  | which serves as the "glue" for all the components of Laravel, and is
  | the IoC container for the system binding all of the various parts.
  |
  */
  
  $app = new Illuminate\Foundation\Application(
      $_ENV['APP_BASE_PATH'] ?? dirname(__DIR__)
  );
  
  /*
  |--------------------------------------------------------------------------
  | Bind Important Interfaces
  |--------------------------------------------------------------------------
  |
  | Next, we need to bind some important interfaces into the container so
  | we will be able to resolve them when needed. The kernels serve the
  | incoming requests to this application from both the web and CLI.
  |
  */
  
  $app-&gt;singleton(
      Illuminate\Contracts\Http\Kernel::class,
      App\Http\Kernel::class
  );
  
  $app-&gt;singleton(
      Illuminate\Contracts\Console\Kernel::class,
      App\Console\Kernel::class
  );
  
  $app-&gt;singleton(
      Illuminate\Contracts\Debug\ExceptionHandler::class,
      App\Exceptions\Handler::class
  );
  
  // $app-&gt;middleware([
  //     Vluzrmos\LumenCors\CorsMiddleware
  // ]);
  
  /*
  |--------------------------------------------------------------------------
  | Return The Application
  |--------------------------------------------------------------------------
  |
  | This script returns the application instance. The instance is given to
  | the calling script so we can separate the building of the instances
  | from the actual running of the application and sending responses.
  |
  */
  
  return $app;
  </code></pre>