title: Laravel and CORS with barryvdh/laravel-cors
body: <p>I'm having an odd problem with CORS in Laravel that I've struggled with for over a day now.  It's different from the other posts I've seen about the laravel-cors package such as this one:
  <a href="https://stackoverflow.com/questions/23135127/laravel-angularjs-cors-using-barryvdh-laravel-cors">Laravel angularJS CORS using barryvdh/laravel-cors</a></p>
  
  <p>I've setup the package according to the instructions, and the only other addition to Laravel I've made is a package for JWT.</p>
  
  <p>What is happening is that CORS is only working in POST requests.  I can use POSTMAN to hit my authenticate route and everything looks good, but as soon as I try any GET request no CORS headers are being sent.  I've tried moving different controllers to my 'unprotected' routes to remove the possibility that JWT is interfering but this doesn't change anything. </p>
  
  <p>Here is my routes.php:</p>
  
  <pre><code>&lt;?php
  
  // unprotected routes
  Route::group(['prefix' =&gt; 'api/v1', 'middleware' =&gt; 'cors'], function () {
    Route::post('authenticate', 'AuthenticateController@authenticate');
    Route::resource('trips', 'TripController'); // moved to unprotected to test CORS
  });
  
  // protected routes
  Route::group(['prefix' =&gt; 'api/v1', 'middleware' =&gt; ['cors', 'jwt.auth']], function () {
    Route::get('authenticate/user', 'AuthenticateController@getAuthenticatedUser');
    Route::resource('airports', 'AirportController');
  
  });
  </code></pre>
  
  <p>And my cors.php:</p>
  
  <pre><code>&lt;?php
  return [
      /*
       |--------------------------------------------------------------------------
       | Laravel CORS
       |--------------------------------------------------------------------------
       |
       | allowedOrigins, allowedHeaders and allowedMethods can be set to array('*')
       | to accept any value, the allowed methods however have to be explicitly listed.
       |
       */
      'supportsCredentials' =&gt; true,
      'allowedOrigins' =&gt; ['*'],
      'allowedHeaders' =&gt; ['*'],
      'allowedMethods' =&gt; ['GET', 'POST', 'PUT', 'OPTIONS',  'DELETE'],
      'exposedHeaders' =&gt; [],
      'maxAge' =&gt; 0,
      'hosts' =&gt; [],
  ];
  </code></pre>
  
  <p>And one of my controllers:</p>
  
  <pre><code>&lt;?php
  
  namespace App\Http\Controllers;
  
  use Illuminate\Http\Request;
  use JWTAuth;
  use Tymon\JWTAuth\Exceptions\JWTException;
  
  class AuthenticateController extends Controller
  {
      public function authenticate(Request $request)
      {
          $credentials = $request-&gt;only('email', 'password');
  
          try {
              // verify the credentials and create a token for the user
              if (!$token = JWTAuth::attempt($credentials)) {
                  return response()-&gt;json(['error' =&gt; 'invalid_credentials'], 401);
              }
          } catch (JWTException $e) {
              // something went wrong
              return response()-&gt;json(['error' =&gt; 'could_not_create_token'], 500);
          }
  
          // if no errors are encountered we can return a JWT
          return response()-&gt;json(compact('token'));
      }
  
      public function getAuthenticatedUser()
      {
          try {
              if (!$user = JWTAuth::parseToken()-&gt;authenticate()) {
                  return response()-&gt;json(['user_not_found'], 404);
              }
          } catch (Tymon\JWTAuth\Exceptions\TokenExpiredException $e) {
              return response()-&gt;json(['token_expired'], $e-&gt;getStatusCode());
          } catch (Tymon\JWTAuth\Exceptions\TokenInvalidException $e) {
              return response()-&gt;json(['token_invalid'], $e-&gt;getStatusCode());
          } catch (Tymon\JWTAuth\Exceptions\JWTException $e) {
              return response()-&gt;json(['token_absent'], $e-&gt;getStatusCode());
          }
  
          // the token is valid and we have found the user via the sub claim
          return response()-&gt;json(compact('user'));
      }
  }
  </code></pre>