{"id":13828098,"url":"https://github.com/spatie/laravel-cors","last_synced_at":"2026-01-15T04:01:20.610Z","repository":{"id":60774704,"uuid":"113957368","full_name":"spatie/laravel-cors","owner":"spatie","description":"Send CORS headers in a Laravel application","archived":true,"fork":false,"pushed_at":"2021-06-10T21:38:12.000Z","size":102,"stargazers_count":597,"open_issues_count":0,"forks_count":57,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-01-14T14:39:23.777Z","etag":null,"topics":["api","cors","javascript","php","request"],"latest_commit_sha":null,"homepage":"https://spatie.be/en/opensource/laravel","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/spatie.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-12-12T07:22:38.000Z","updated_at":"2025-11-28T01:00:23.000Z","dependencies_parsed_at":"2022-10-04T15:46:39.102Z","dependency_job_id":null,"html_url":"https://github.com/spatie/laravel-cors","commit_stats":null,"previous_names":[],"tags_count":26,"template":false,"template_full_name":null,"purl":"pkg:github/spatie/laravel-cors","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spatie%2Flaravel-cors","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spatie%2Flaravel-cors/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spatie%2Flaravel-cors/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spatie%2Flaravel-cors/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/spatie","download_url":"https://codeload.github.com/spatie/laravel-cors/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spatie%2Flaravel-cors/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28442357,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-15T00:55:22.719Z","status":"online","status_checked_at":"2026-01-15T02:00:08.019Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api","cors","javascript","php","request"],"created_at":"2024-08-04T09:02:32.211Z","updated_at":"2026-01-15T04:01:20.592Z","avatar_url":"https://github.com/spatie.png","language":"PHP","funding_links":["https://www.patreon.com/spatie"],"categories":["PHP"],"sub_categories":[],"readme":"# Notice\n\nWe have abandoned this package because Laravel 7 introduced native support for CORS. Only use this package if you're on Laravel 6 or below.\n\n# Send CORS headers in a Laravel application\n\n[![Latest Version on Packagist](https://img.shields.io/packagist/v/spatie/laravel-cors.svg?style=flat-square)](https://packagist.org/packages/spatie/laravel-cors)\n[![Build Status](https://img.shields.io/travis/spatie/laravel-cors/master.svg?style=flat-square)](https://travis-ci.org/spatie/laravel-cors)\n[![Quality Score](https://img.shields.io/scrutinizer/g/spatie/laravel-cors.svg?style=flat-square)](https://scrutinizer-ci.com/g/spatie/laravel-cors)\n[![StyleCI](https://styleci.io/repos/113957368/shield?branch=master)](https://styleci.io/repos/113957368)\n[![Total Downloads](https://img.shields.io/packagist/dt/spatie/laravel-cors.svg?style=flat-square)](https://packagist.org/packages/spatie/laravel-cors)\n\nThis package will add CORS headers to the responses of your Laravel or Lumen app. For more infomation about CORS, see the [Mozilla CORS documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS).\n\nThis package supports preflight requests and is easily configurable to fit your needs.\n\n## Installation\n\n- [Laravel](#laravel)\n- [Lumen](#lumen)\n\n### Laravel\n\nYou can install the package via Composer:\n\n```bash\ncomposer require spatie/laravel-cors\n```\n\nThe package will automatically register its service provider.\n\nThe provided `Spatie\\Cors\\Cors` middleware must be registered in the global middleware group.\n\n```php\n// app/Http/Kernel.php\n\nprotected $middleware = [\n    ...\n    \\Spatie\\Cors\\Cors::class\n];\n```\n\n```php\nphp artisan vendor:publish --provider=\"Spatie\\Cors\\CorsServiceProvider\" --tag=\"config\"\n```\n\nThis is the default content of the config file published at `config/cors.php`:\n\n```php\nreturn [\n    /*\n     * A cors profile determines which origins, methods, headers are allowed for\n     * a given requests. The `DefaultProfile` reads its configuration from this\n     * config file.\n     *\n     * You can easily create your own cors profile.\n     * More info: https://github.com/spatie/laravel-cors/#creating-your-own-cors-profile\n     */\n    'cors_profile' =\u003e Spatie\\Cors\\CorsProfile\\DefaultProfile::class,\n\n    /*\n     * This configuration is used by `DefaultProfile`.\n     */\n    'default_profile' =\u003e [\n\n        'allow_credentials' =\u003e false,\n\n        'allow_origins' =\u003e [\n            '*',\n        ],\n\n        'allow_methods' =\u003e [\n            'POST',\n            'GET',\n            'OPTIONS',\n            'PUT',\n            'PATCH',\n            'DELETE',\n        ],\n\n        'allow_headers' =\u003e [\n            'Content-Type',\n            'X-Auth-Token',\n            'Origin',\n            'Authorization',\n        ],\n\n        'expose_headers' =\u003e [\n            'Cache-Control',\n            'Content-Language',\n            'Content-Type',\n            'Expires',\n            'Last-Modified',\n            'Pragma',\n        ],\n\n        'forbidden_response' =\u003e [\n            'message' =\u003e 'Forbidden (cors).',\n            'status' =\u003e 403,\n        ],\n\n        /*\n         * Preflight request will respond with value for the max age header.\n         */\n        'max_age' =\u003e 60 * 60 * 24,\n    ],\n];\n```\n\n### Lumen\n\nYou can install the package via Composer:\n\n```bash\ncomposer require spatie/laravel-cors\n```\n\nCopy the config file from the vendor directory:\n\n```bash\ncp vendor/spatie/laravel-cors/config/cors.php config/cors.php\n```\n\nRegister the config file, the middleware and the service provider in `bootstrap/app.php`:\n\n```php\n$app-\u003econfigure('cors');\n\n$app-\u003emiddleware([\n    Spatie\\Cors\\Cors::class,\n]);\n\n$app-\u003eregister(Spatie\\Cors\\CorsServiceProvider::class);\n```\n\n## Usage\n\nWith the middleware installed your API routes should now get appropriate CORS headers. Preflight requests will be handled as well. If a request comes in that is not allowed, Laravel will return a `403` response.\n\nThe default configuration of this package allows all requests from any origin (denoted as `'*'`). You probably want to at least specify some origins relevant to your project. If you want to allow requests to come in from `https://spatie.be` and `https://laravel.com` add those domains to the config file:\n\n```php\n// config/cors.php\n\n    ...\n    'default_profile' =\u003e [\n\n    'allow_origins' =\u003e [\n        'https://spatie.be',\n        'https://laravel.com',\n    ],\n    ...\n...\n```\n\nIf you, for example, want to allow all subdomains from a specific domain, you can use the wildcard asterisk (`*`) and specifiy that:\n```php\n// config/cors.php\n\n    ...\n    'default_profile' =\u003e [\n\n    'allow_origins' =\u003e [\n        'https://spatie.be',\n        'https://laravel.com',\n\n        'https://*.spatie.be',\n        'https://*.laravel.com',\n    ],\n    ...\n...\n```\n\n### Creating your own CORS profile\n\nImagine you want to specify allowed origins based on the user that is currently logged in. In that case the `DefaultProfile` which just reads the config file won't cut it. Fortunately it's very easy to write your own CORS profile, which is simply a class that extends `Spatie\\Cors\\DefaultProfile`.\n\nHere's a quick example where it is assumed that you've already added an `allowed_domains` column on your user model:\n\n```php\nnamespace App\\Services\\Cors;\n\nuse Spatie\\Cors\\CorsProfile\\DefaultProfile;\n\nclass UserBasedCorsProfile extends DefaultProfile\n{\n    public function allowOrigins(): array\n    {\n        return Auth::user()-\u003eallowed_domains;\n    }\n}\n```\n\nYou can override the default HTTP status code and message returned when a request is forbidden by editing the `forbidden_response` array in your configuration file:\n\n```php\n'forbidden_response' =\u003e [\n    'message' =\u003e 'Your request failed',\n    'status' =\u003e 400,\n],\n```\n\nDon't forget to register your profile in the config file.\n\n```php\n// config/cors.php\n\n ...\n 'cors_profile' =\u003e App\\Services\\Cors\\UserBasedCorsProfile::class,\n ...\n```\n\nIn the example above we've overwritten the `allowOrigins` method, but of course you may choose to override any of the methods present in `DefaultProfile`.\n\n## Testing\n\n``` bash\ncomposer test\n```\n\n## Changelog\n\nPlease see [CHANGELOG](CHANGELOG.md) for more information what has changed recently.\n\n## Contributing\n\nPlease see [CONTRIBUTING](CONTRIBUTING.md) for details.\n\n## Security\n\nIf you discover any security related issues, please email freek@spatie.be instead of using the issue tracker.\n\n## Alternatives\n\n- [barryvdh/laravel-cors](https://github.com/barryvdh/laravel-cors): a tried and tested package. Our package is a modern rewrite of the basic features of Barry's excellent one. We created our own solution because we needed our configuration to be [very flexible](#creating-your-own-cors-profile).\n\n## Postcardware\n\nYou're free to use this package, but if it makes it to your production environment we highly appreciate you sending us a postcard from your hometown, mentioning which of our package(s) you are using.\n\nOur address is: Spatie, Samberstraat 69D, 2060 Antwerp, Belgium.\n\nWe publish all received postcards [on our company website](https://spatie.be/en/opensource/postcards).\n\n## Credits\n\n- [Freek Van der Herten](https://github.com/freekmurze)\n- [All Contributors](../../contributors)\n\n## Support us\n\nSpatie is a webdesign agency based in Antwerp, Belgium. You'll find an overview of all our open source projects [on our website](https://spatie.be/opensource).\n\nDoes your business depend on our contributions? Reach out and support us on [Patreon](https://www.patreon.com/spatie).\nAll pledges will be dedicated to allocating workforce on maintenance and new awesome stuff.\n\n## License\n\nThe MIT License (MIT). Please see [License File](LICENSE.md) for more information.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspatie%2Flaravel-cors","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fspatie%2Flaravel-cors","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspatie%2Flaravel-cors/lists"}