title: Adding Access-Control-Allow-Origin to Laravel
body: <p>The app in question (I am simply trying to maintain/bug fix - I am not the author) (Laravel 5.1.7) needs to call JavaScript located at s7.addthis.com. This is currently not working and is returning a Cross-Origin Request Blocked error. After doing some research, I found barryvdh/laravel-cors which seems to be the preferred method for addressing this problem. However, I believe that I have followed all of the instructions, but the Access-Control-Allow-Origin is not appearing in the output.</p>
  
  <p>These are the steps I followed (I am a Laravel novice...):</p>
  
  <ol>
  <li>composer require barryvdh/laravel-cors 0.7.x </li>
  <li>composer update </li>
  <li>cp vendor/barryvdh/laravel-cors/config config (did not customize)</li>
  <li>Added 'Barryvdh\Cors\ServiceProvider', to the $providers array in config/app.php</li>
  <li>Added 'Barryvdh\Cors\HandleCors', to the $middleware array in app/Http/kernel.php</li>
  <li>php artisan vendor:publish --provider="Barryvdh\Cors\ServiceProvider"</li>
  </ol>
  
  <p>The header is still not being added to the output, i.e., the errors persists. What step did I miss and/or what did I do wrong?</p>
  
  <p>In an attempt to just things working, I tried adding the following to the top of bootstrap\app.php</p>
  
  <pre><code>// allow origin
  header('Access-Control-Allow-Origin: *');
  // add any additional headers you need to support here
  header('Access-Control-Allow-Headers: Origin, Content-Type');
  </code></pre>
  
  <p>but this too had no effect.</p>
  
  <p>I did see this post: <a href="http://en.vedovelli.com.br/2015/web-development/Laravel-5-1-enable-CORS/" rel="nofollow">http://en.vedovelli.com.br/2015/web-development/Laravel-5-1-enable-CORS/</a>, which looks straight-forward enough, but in my app, the javascript is called in this manner: <code>{!! Html::script('//s7.addthis.com/js/300/addthis_widget.js#pubid=xxx', array('async' =&gt; 'async')) !!}</code> and I do not know how to cast this into the form shown.</p>
  
  <p>Thank you.</p>
  
  <p>In response to SSahut:</p>
  
  <pre><code>protected $middleware = [
      \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
      \App\Http\Middleware\EncryptCookies::class,
      \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
      \Illuminate\Session\Middleware\StartSession::class,
      \Illuminate\View\Middleware\ShareErrorsFromSession::class,
      \App\Http\Middleware\VerifyCsrfToken::class,
      'Barryvdh\Cors\HandleCors',
  ];
  </code></pre>