PHPackages                             ibpavlov/laravel-cors - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [API Development](/categories/api)
4. /
5. ibpavlov/laravel-cors

ActiveLibrary[API Development](/categories/api)

ibpavlov/laravel-cors
=====================

Adds CORS (Cross-Origin Resource Sharing) headers support in your Laravel application

0.11.0(6y ago)051MITPHPPHP >=5.5.9

Since Dec 15Pushed 6y ago1 watchersCompare

[ Source](https://github.com/ibpavlov/laravel-cors)[ Packagist](https://packagist.org/packages/ibpavlov/laravel-cors)[ RSS](/packages/ibpavlov-laravel-cors/feed)WikiDiscussions master Synced yesterday

READMEChangelog (1)Dependencies (6)Versions (31)Used By (0)

CORS Middleware for Laravel 5
=============================

[](#cors-middleware-for-laravel-5)

[![Latest Version on Packagist](https://camo.githubusercontent.com/88ec5d8f5bf3f59850c694ea9c080d61e841759489bf4a73a32334de37362145/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f62617272797664682f6c61726176656c2d636f72732e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/barryvdh/laravel-cors)[![Software License](https://camo.githubusercontent.com/55c0218c8f8009f06ad4ddae837ddd05301481fcf0dff8e0ed9dadda8780713e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d627269676874677265656e2e7376673f7374796c653d666c61742d737175617265)](LICENSE.md)[![Build Status](https://camo.githubusercontent.com/13ba805de5177d1d339f3297654b3fb7fc99558a083e4c71768d77f6b742b2ec/68747470733a2f2f696d672e736869656c64732e696f2f7472617669732f62617272797664682f6c61726176656c2d636f72732f6d61737465722e7376673f7374796c653d666c61742d737175617265)](https://travis-ci.org/barryvdh/laravel-cors)[![Total Downloads](https://camo.githubusercontent.com/2911fc7a35e8c988b2d3b1524c65a6fef45a7fc4f9fb42d97433a780e4f13318/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f62617272797664682f6c61726176656c2d636f72732e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/barryvdh/laravel-cors)

Based on

About
-----

[](#about)

The `laravel-cors` package allows you to send [Cross-Origin Resource Sharing](http://enable-cors.org/)headers with Laravel middleware configuration.

If you want to have have a global overview of CORS workflow, you can browse this [image](http://www.html5rocks.com/static/images/cors_server_flowchart.png).

Features
--------

[](#features)

- Handles CORS pre-flight OPTIONS requests
- Adds CORS headers to your responses

Installation
------------

[](#installation)

Require the `barryvdh/laravel-cors` package in your `composer.json` and update your dependencies:

```
$ composer require barryvdh/laravel-cors
```

Add the Cors\\ServiceProvider to your `config/app.php` providers array:

```
Barryvdh\Cors\ServiceProvider::class,
```

Global usage
------------

[](#global-usage)

To allow CORS for all your routes, add the `HandleCors` middleware in the `$middleware` property of `app/Http/Kernel.php` class:

```
protected $middleware = [
    // ...
    \Barryvdh\Cors\HandleCors::class,
];
```

Group middleware
----------------

[](#group-middleware)

If you want to allow CORS on a specific middleware group or route, add the `HandleCors` middleware to your group:

```
protected $middlewareGroups = [
    'web' => [
       // ...
    ],

    'api' => [
        // ...
        \Barryvdh\Cors\HandleCors::class,
    ],
];
```

Configuration
-------------

[](#configuration)

The defaults are set in `config/cors.php`. Copy this file to your own config directory to modify the values. You can publish the config using this command:

```
$ php artisan vendor:publish --provider="Barryvdh\Cors\ServiceProvider"
```

> **Note:** When using custom headers, like `X-Auth-Token` or `X-Requested-With`, you must set the `allowedHeaders` to include those headers. You can also set it to `array('*')` to allow all custom headers.

> **Note:** If you are explicitly whitelisting headers, you must include `Origin` or requests will fail to be recognized as CORS.

```
return [
     /*
     |--------------------------------------------------------------------------
     | Laravel CORS
     |--------------------------------------------------------------------------
     |
     | allowedOrigins, allowedHeaders and allowedMethods can be set to array('*')
     | to accept any value.
     |
     */
    'supportsCredentials' => false,
    'allowedOrigins' => ['*'],
    'allowedHeaders' => ['Content-Type', 'X-Requested-With'],
    'allowedMethods' => ['*'], // ex: ['GET', 'POST', 'PUT',  'DELETE']
    'exposedHeaders' => [],
    'maxAge' => 0,
]
```

`allowedOrigins`, `allowedHeaders` and `allowedMethods` can be set to `array('*')` to accept any value.

> **Note:** Try to be a specific as possible. You can start developing with loose constraints, but it's better to be as strict as possible!

> **Note:** Because of [http method overriding](http://symfony.com/doc/current/reference/configuration/framework.html#http-method-override) in Laravel, allowing POST methods will also enable the API users to perform PUT and DELETE requests as well.

### Lumen

[](#lumen)

On Laravel Lumen, load your configuration file manually in `bootstrap/app.php`:

```
$app->configure('cors');
```

And register the ServiceProvider:

```
$app->register(Barryvdh\Cors\ServiceProvider::class);
```

Global usage for Lumen
----------------------

[](#global-usage-for-lumen)

To allow CORS for all your routes, add the `HandleCors` middleware to the global middleware:

```
$app->middleware([
    // ...
    \Barryvdh\Cors\HandleCors::class,
]);
```

Group middleware for Lumen
--------------------------

[](#group-middleware-for-lumen)

If you want to allow CORS on a specific middleware group or route, add the `HandleCors` middleware to your group:

```
$app->routeMiddleware([
    // ...
    'cors' => \Barryvdh\Cors\HandleCors::class,
]);
```

Common problems and errors (Pre Laravel 5.3)
--------------------------------------------

[](#common-problems-and-errors-pre-laravel-53)

In order for the package to work, the request has to be a valid CORS request and needs to include an "Origin" header.

When an error occurs, the middleware isn't run completely. So when this happens, you won't see the actual result, but will get a CORS error instead.

This could be a CSRF token error or just a simple problem.

> **Note:** This should be working in Laravel 5.3+.

### Disabling CSRF protection for your API

[](#disabling-csrf-protection-for-your-api)

If possible, use a different route group with CSRF protection enabled. Otherwise you can disable CSRF for certain requests in `App\Http\Middleware\VerifyCsrfToken`:

```
protected $except = [
    'api/*'
];
```

License
-------

[](#license)

Released under the MIT License, see [LICENSE](LICENSE).

###  Health Score

27

—

LowBetter than 49% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity5

Limited adoption so far

Community21

Small or concentrated contributor base

Maturity59

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 77.1% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~69 days

Recently: every ~162 days

Total

30

Last Release

2532d ago

PHP version history (3 changes)v0.1PHP >=5.3.0

v0.3.0PHP >=5.4.0

v0.8.0PHP >=5.5.9

### Community

Maintainers

![](https://www.gravatar.com/avatar/13f0f9ef89e037664e6da86d5213823d6c8639b34d16578ef8d6a7a849571960?d=identicon)[ibpavlov](/maintainers/ibpavlov)

---

Top Contributors

[![barryvdh](https://avatars.githubusercontent.com/u/973269?v=4)](https://github.com/barryvdh "barryvdh (118 commits)")[![jfexyz](https://avatars.githubusercontent.com/u/66879?v=4)](https://github.com/jfexyz "jfexyz (2 commits)")[![honeroku](https://avatars.githubusercontent.com/u/1676856?v=4)](https://github.com/honeroku "honeroku (2 commits)")[![GrahamCampbell](https://avatars.githubusercontent.com/u/2829600?v=4)](https://github.com/GrahamCampbell "GrahamCampbell (2 commits)")[![binhqx](https://avatars.githubusercontent.com/u/582192?v=4)](https://github.com/binhqx "binhqx (2 commits)")[![whoan](https://avatars.githubusercontent.com/u/7103003?v=4)](https://github.com/whoan "whoan (2 commits)")[![adamwathan](https://avatars.githubusercontent.com/u/4323180?v=4)](https://github.com/adamwathan "adamwathan (2 commits)")[![ibpavlov](https://avatars.githubusercontent.com/u/3340235?v=4)](https://github.com/ibpavlov "ibpavlov (1 commits)")[![irazasyed](https://avatars.githubusercontent.com/u/1915268?v=4)](https://github.com/irazasyed "irazasyed (1 commits)")[![jamiehd](https://avatars.githubusercontent.com/u/4728169?v=4)](https://github.com/jamiehd "jamiehd (1 commits)")[![jpmurray](https://avatars.githubusercontent.com/u/1550428?v=4)](https://github.com/jpmurray "jpmurray (1 commits)")[![jrean](https://avatars.githubusercontent.com/u/5646128?v=4)](https://github.com/jrean "jrean (1 commits)")[![klemenb](https://avatars.githubusercontent.com/u/2099210?v=4)](https://github.com/klemenb "klemenb (1 commits)")[![lamoimage](https://avatars.githubusercontent.com/u/10320760?v=4)](https://github.com/lamoimage "lamoimage (1 commits)")[![lucasmichot](https://avatars.githubusercontent.com/u/513603?v=4)](https://github.com/lucasmichot "lucasmichot (1 commits)")[![marktinsley](https://avatars.githubusercontent.com/u/303598?v=4)](https://github.com/marktinsley "marktinsley (1 commits)")[![martintern](https://avatars.githubusercontent.com/u/13314337?v=4)](https://github.com/martintern "martintern (1 commits)")[![nyanlynnhtut](https://avatars.githubusercontent.com/u/1456363?v=4)](https://github.com/nyanlynnhtut "nyanlynnhtut (1 commits)")[![pawel-damasiewicz](https://avatars.githubusercontent.com/u/489857?v=4)](https://github.com/pawel-damasiewicz "pawel-damasiewicz (1 commits)")[![physio](https://avatars.githubusercontent.com/u/729118?v=4)](https://github.com/physio "physio (1 commits)")

---

Tags

apilaravelcorscrossdomain

###  Code Quality

TestsPHPUnit

Code StylePHP\_CodeSniffer

### Embed Badge

![Health badge](/badges/ibpavlov-laravel-cors/health.svg)

```
[![Health](https://phpackages.com/badges/ibpavlov-laravel-cors/health.svg)](https://phpackages.com/packages/ibpavlov-laravel-cors)
```

###  Alternatives

[nelmio/cors-bundle

Adds CORS (Cross-Origin Resource Sharing) headers support in your Symfony application

1.9k94.4M153](/packages/nelmio-cors-bundle)[mollie/laravel-mollie

Mollie API client wrapper for Laravel & Mollie Connect provider for Laravel Socialite

3624.1M28](/packages/mollie-laravel-mollie)[dragon-code/laravel-json-response

Automatically always return a response in JSON format

1118.6k1](/packages/dragon-code-laravel-json-response)[specialtactics/l5-api

Dependencies for the Laravel API Boilerplate package

3672.8k2](/packages/specialtactics-l5-api)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)