PHPackages                             luminouslabs/ll-laravel-cors - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [HTTP & Networking](/categories/http)
4. /
5. luminouslabs/ll-laravel-cors

ActiveLibrary[HTTP & Networking](/categories/http)

luminouslabs/ll-laravel-cors
============================

Adds CORS (Cross-Origin Resource Sharing) headers support in your Laravel application

1985↓100%JavaScript

Since Aug 16Pushed 2y ago1 watchersCompare

[ Source](https://github.com/luminouslabsbd/ll-laravel-cors)[ Packagist](https://packagist.org/packages/luminouslabs/ll-laravel-cors)[ RSS](/packages/luminouslabs-ll-laravel-cors/feed)WikiDiscussions main Synced 1mo ago

READMEChangelogDependenciesVersions (1)Used By (0)

Note for users upgrading to Laravel 9, 10 or higher
---------------------------------------------------

[](#note-for-users-upgrading-to-laravel-9-10-or-higher)

### This package is deprecated because all supported Laravel versions now include the CORS middleware in the core.

[](#this-package-is-deprecated-because-all-supported-laravel-versions-now-include-the-cors-middleware-in-the-core)

Since Laravel 9.2, this Middleware is included in laravel/framework. You can use the provided middleware, which should be compatible with the Middleware and config provided in this package. See  for the changes.

Features
--------

[](#features)

- Handles CORS pre-flight OPTIONS requests
- Adds CORS headers to your responses
- Match routes to only add CORS to certain Requests

Installation
------------

[](#installation)

Require the `luminouslabs/ll-laravel-cors` package in your `composer.json` and update your dependencies:

```
composer require luminouslabs/ll-laravel-cors
```

If you get a conflict, this could be because an older version of luminouslabs/ll-laravel-cors is installed. Remove the conflicting package first, then try install again:

```
composer remove barryvdh/laravel-cors fruitcake/laravel-cors
composer require luminouslabs/ll-laravel-cors
```

Global usage
------------

[](#global-usage)

To allow CORS for all your routes, add the `HandleCors` middleware at the top of the `$middleware` property of `app/Http/Kernel.php` class:

```
protected $middleware = [
  \Fruitcake\Cors\HandleCors::class,
    // ...
];
```

Now update the config to define the paths you want to run the CORS service on, (see Configuration below):

```
'paths' => ['api/*'],
```

Configuration
-------------

[](#configuration)

The defaults are set in `config/cors.php`. Publish the config to copy the file to your own config:

```
php artisan vendor:publish --tag="cors"
```

> **Note:** When using custom headers, like `X-Auth-Token` or `X-Requested-With`, you must set the `allowed_headers` to include those headers. You can also set it to `['*']` to allow all custom headers.

> **Note:** If you are explicitly whitelisting headers, you must include `Origin` or requests will fail to be recognized as CORS.

### Options

[](#options)

OptionDescriptionDefault valuepathsYou can enable CORS for 1 or multiple paths, eg. `['api/*'] ``[]`allowed\_methodsMatches the request method.`['*']`allowed\_originsMatches the request origin. Wildcards can be used, eg. `*.mydomain.com` or `mydomain.com:*``['*']`allowed\_origins\_patternsMatches the request origin with `preg_match`.`[]`allowed\_headersSets the Access-Control-Allow-Headers response header.`['*']`exposed\_headersSets the Access-Control-Expose-Headers response header.`[]`max\_ageSets the Access-Control-Max-Age response header.`0`supports\_credentialsSets the Access-Control-Allow-Credentials header.`false``allowed_origins`, `allowed_headers` and `allowed_methods` can be set to `['*']` to accept any value.

> **Note:** For `allowed_origins` you must include the scheme when not using a wildcard, eg. `['http://example.com', 'https://example.com']`. You must also take into account that the scheme will be present when using `allowed_origins_patterns`.

> **Note:** Try to be as specific as possible. You can start developing with loose constraints, but it's better to be as strict as possible!

> **Note:** Because of [http method overriding](http://symfony.com/doc/current/reference/configuration/framework.html#http-method-override) in Laravel, allowing POST methods will also enable the API users to perform PUT and DELETE requests as well.

> **Note:** Sometimes it's necessary to specify the port *(when you're coding your app in a local environment for example)*. You can specify the port or using a wildcard here too, eg. `localhost:3000`, `localhost:*` or even using a FQDN `app.mydomain.com:8080`

### Lumen

[](#lumen)

On Lumen, just register the ServiceProvider manually in your `bootstrap/app.php` file:

```
$app->register(Fruitcake\Cors\CorsServiceProvider::class);
```

```
$app->configure('cors');
```

Global usage for Lumen
----------------------

[](#global-usage-for-lumen)

To allow CORS for all your routes, add the `HandleCors` middleware to the global middleware and set the `paths` property in the config.

```
$app->middleware([
    // ...
    Fruitcake\Cors\HandleCors::class,
]);
```

Common problems
---------------

[](#common-problems)

### Wrong config

[](#wrong-config)

Make sure the `path` option in the config is correct and actually matches the route you are using. Remember to clear the config cache as well.

### Error handling, Middleware order

[](#error-handling-middleware-order)

Sometimes errors/middleware that return own responses can prevent the CORS Middleware from being run. Try changing the order of the Middleware and make sure it's the first entry in the global middleware, not a route group. Also check your logs for actual errors, because without CORS, the errors will be swallowed by the browser, only showing CORS errors. Also try running it without CORS to make sure it actually works.

### Authorization headers / Credentials

[](#authorization-headers--credentials)

If your Request includes an Authorization header or uses Credentials mode, set the `supports_credentials` value in the config to true. This will set the [Access-Control-Allow-Credentials](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials) Header to `true`.

### Echo/die

[](#echodie)

If you use `echo()`, `dd()`, `die()`, `exit()`, `dump()` etc in your code, you will break the Middleware flow. When output is sent before headers, CORS cannot be added. When the script exits before the CORS middleware finishes, CORS headers will not be added. Always return a proper response or throw an Exception.

### Disabling CSRF protection for your API

[](#disabling-csrf-protection-for-your-api)

If possible, use a route group with CSRF protection disabled. Otherwise you can disable CSRF for certain requests in `App\Http\Middleware\VerifyCsrfToken`:

```
protected $except = [
    'api/*',
    'sub.domain.zone' => [
      'prefix/*'
    ],
];
```

### Duplicate headers

[](#duplicate-headers)

The CORS Middleware should be the only place you add these headers. If you also add headers in .htaccess, nginx or your index.php file, you will get duplicate headers and unexpected results.

### No Cross-Site requests

[](#no-cross-site-requests)

If you are not doing Cross-Site requests, meaning if you are not requesting site-a.com/api from site-b.com, your browser will not send the `Origin: https://site-b.com` request header, CORS will be "disabled" as the `Access-Control-Allow-Origin` header will be also missing. This happens because requests are being dispatched from the same and no protection is needed in this case.

###  Health Score

18

—

LowBetter than 8% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity17

Limited adoption so far

Community9

Small or concentrated contributor base

Maturity21

Early-stage or recently created project

 Bus Factor1

Top contributor holds 71.4% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

### Community

Maintainers

![](https://www.gravatar.com/avatar/36086e12fa7b4cb927a5074c812193ae079630927a62edd3bfb524bab56ecd1c?d=identicon)[luminouslabs](/maintainers/luminouslabs)

---

Top Contributors

[![zunaidmiah](https://avatars.githubusercontent.com/u/45538749?v=4)](https://github.com/zunaidmiah "zunaidmiah (5 commits)")[![mdsohelrana71](https://avatars.githubusercontent.com/u/55734325?v=4)](https://github.com/mdsohelrana71 "mdsohelrana71 (2 commits)")

### Embed Badge

![Health badge](/badges/luminouslabs-ll-laravel-cors/health.svg)

```
[![Health](https://phpackages.com/badges/luminouslabs-ll-laravel-cors/health.svg)](https://phpackages.com/packages/luminouslabs-ll-laravel-cors)
```

###  Alternatives

[friendsofsymfony/rest-bundle

This Bundle provides various tools to rapidly develop RESTful API's with Symfony

2.8k73.3M319](/packages/friendsofsymfony-rest-bundle)[php-http/discovery

Finds and installs PSR-7, PSR-17, PSR-18 and HTTPlug implementations

1.3k309.5M1.2k](/packages/php-http-discovery)[nyholm/psr7

A fast PHP7 implementation of PSR-7

1.3k235.4M2.4k](/packages/nyholm-psr7)[pusher/pusher-php-server

Library for interacting with the Pusher REST API

1.5k94.8M293](/packages/pusher-pusher-php-server)[spatie/crawler

Crawl all internal links found on a website

2.8k16.3M52](/packages/spatie-crawler)[react/http

Event-driven, streaming HTTP client and server implementation for ReactPHP

78126.4M414](/packages/react-http)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)