barryvdh/laravel-cors not working for my routes

Question

I'm using [this laravel-cors package][1], I've read the docs and I've added the service provider to config/app.php.

After adding the middleware to kernel.php like so:

  protected $middleware = [
  \Barryvdh\Cors\HandleCors::class,
    \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,

];

It works for my passport routes, but not for my own routes.

Passport routes

Route::group([
    'middleware' => ['api']
], function ($router) {
    Passport::routes();
    Passport::tokensExpireIn(Carbon::now()->addDays(15));
    Passport::refreshTokensExpireIn(Carbon::now()->addDays(30));
});

My routes

Route::group(['middleware' => ['auth:api']], function () {
    Route::resource('answers', 'AnswersController');
});

Answer 1

I've read the entire code of the CORS middleware. It will only add headers, as per the RFC, when:

1. The request is a Pre-Flight request (OPTIONS)
2. The request has an Origin header other than the one your API resides on.
3. The remote host that is trying to join your API is allowed as per the CORS config.

Make sure you publish the CORS config and edit it to your needs.

See the source