title: Laravel “CSRF token mismatch” for POST with laravel-cors and axios
body: <p>I have a domain_A running <strong>Laravel 5.8</strong>  engine to return API on <em>web route</em>. It must check origins to let serve just a few domains, included domain_B.</p>
  
  <p><strong>Barryvdh/laravel-cors</strong><br>
  I installed <a href="https://github.com/barryvdh/laravel-cors" rel="nofollow noreferrer">barryvdh/laravel-cors</a> by composer and configured it globally updating the Kernel.php. This should works on web route too.</p>
  
  <p><strong>kernel.php</strong></p>
  
  <pre><code>protected $middleware = [
     ...
    \Barryvdh\Cors\HandleCors::class,
  ];
  </code></pre>
  
  <p>Then I config the <strong>Laravel Cors</strong> using the standard configuration as test to allow any domain.</p>
  
  <p><strong>/config/cors.php</strong></p>
  
  <pre><code> return [
      'supportsCredentials' =&gt; false,
      'allowedOrigins' =&gt; ['http:www.domain_b.com','https:www.domain_b.com','http:domain_b.com'],
      'allowedHeaders' =&gt; ['Access-Control-Allow-Origin', 'X-CSRF-TOKEN', 'Content-Type', 'X-Requested-With'],
      'allowedMethods' =&gt; ['*'], // ex: ['GET', 'POST', 'PUT',  'DELETE']
      'exposedHeaders' =&gt; [],
      'maxAge' =&gt; 0,
  ];
  </code></pre>
  
  <p>The axios config is:</p>
  
  <p><strong>(domain_a)/ Repository.js</strong></p>
  
  <pre><code>import axios from 'axios/index';
  
  const baseDomain = "https://domain_a";
  const baseURL = `${baseDomain}`;
  
  let withCredentials = false;
  
  const token = document.head.querySelector('meta[name="csrf-token"]');
  
  const headers = {
     'X-CSRF-TOKEN': token.content,
     'Access-Control-Allow-Origin': '*',
     'X-Requested-With': 'XMLHttpRequest',
     'Content-Type': 'application/json',
  };
  
  
  export default axios.create({
      baseURL,
      withCredentials: withCredentials,
      headers: headers
  });
  </code></pre>
  
  <p>GET requests are filtered as well, PUT request return a 419 error why? I have set 'allowedMethods' => ['*'] so it should work...  what I'm missing?</p>
  
  <p>[<strong>EDIT</strong>]</p>
  
  <p>ON debug I got this error right now...</p>
  
  <blockquote>
    <p>message: "CSRF token mismatch." </p>
  </blockquote>
  
  <p>Why POST doesn't get the header Token?</p>
  
  <p>I tried to pass the POST token also like this:</p>
  
  <pre><code> const token = document.head.querySelector('meta[name="csrf-token"]');
  const options = {
      headers: {
          'Authorization' :  'bearer '+token.content,
      }
  };
  const body = {};
  return Repository.post(`${resource}/${$playerId}/${$cozzaloID}`, body, options)
  </code></pre>
  
  <p><strong>Preflight Header Response</strong></p>
  
  <pre><code> Access-Control-Allow-Headers: authorization, content-type, x-requested-with, x-csrf-token
   Access-Control-Allow-Methods: POST
   Access-Control-Allow-Origin: http://www.******.**
   Cache-Control: no-cache, private
   Connection: Keep-Alive
   Content-Length: 0
   Content-Type: text/html; charset=UTF-8
   Date: Mon, 01 Jul 2019 05:14:22 GMT
   Keep-Alive: timeout=5, max=98
   Server: Apache
   X-Powered-By: PHP/7.1.30, PleskLin
  </code></pre>
  
  <p><strong>Header Response</strong>:</p>
  
  <pre><code>Access-Control-Allow-Origin: http://www.xxxxxxx.xx
  Cache-Control: no-cache, private
  Connection: Keep-Alive
  Content-Type: application/json
  Date: Mon, 01 Jul 2019 05:14:22 GMT
  Keep-Alive: timeout=5, max=97
  Server: Apache
  Transfer-Encoding: chunked
  Vary: Origin,Authorization
  X-Powered-By: PHP/7.1.30, PleskLin
  </code></pre>
  
  <p><strong>Header Request</strong>:</p>
  
  <pre><code>Provisional headers are shown
  Accept: application/json, text/plain, */*
  Authorization: Bearer jW6pFcVlkKyApCxtZIlfaHDPMSFWCWcbnPPTQ7EJ
  Content-Type: application/json
  Origin: http://www.xxxxxxx.xx 
  Referer: http://www.xxxxxx.xx/players/739
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) 
  AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 
  Safari/537.36
  X-CSRF-TOKEN: jW6pFcVlkKyApCxtZIlfaHDPMSFWCWcbnPPTQ7EJ
  X-Requested-With: XMLHttpRequest
  </code></pre>
  
  <p><em>Note about <strong>token</em></strong>: It should be OK because it is the same as another GET request done in the same task.</p>