[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-8295":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":16,"stars7d":16,"stars30d":14,"stars90d":16,"forks30d":16,"starsTrendScore":16,"compositeScore":17,"rankGlobal":10,"rankLanguage":10,"license":18,"archived":19,"fork":20,"defaultBranch":21,"hasWiki":20,"hasPages":20,"topics":22,"createdAt":10,"pushedAt":10,"updatedAt":28,"readmeContent":29,"aiSummary":30,"trendingCount":16,"starSnapshotCount":16,"syncStatus":31,"lastSyncTime":32,"discoverSource":33},8295,"laravel-cors","fruitcake\u002Flaravel-cors","fruitcake","Adds CORS (Cross-Origin Resource Sharing) headers support in your Laravel application","",null,"PHP",6242,609,1,37,0,39.36,"MIT License",true,false,"master",[23,24,25,26,27],"cors","hacktoberfest","laravel","middleware","php","2026-06-12 02:01:51","# CORS Middleware for Laravel\n\n[![Build Status][ico-actions]][link-actions]\n[![Latest Stable Version](https:\u002F\u002Fposer.pugx.org\u002Ffruitcake\u002Flaravel-cors\u002Fversion.png)](https:\u002F\u002Fpackagist.org\u002Fpackages\u002Ffruitcake\u002Flaravel-cors)\n[![Software License][ico-license]](LICENSE.md)\n[![Total Downloads][ico-downloads]][link-downloads]\n[![Fruitcake](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FPowered%20By-Fruitcake-b2bc35.svg)](https:\u002F\u002Ffruitcake.nl\u002F)\n\nImplements https:\u002F\u002Fgithub.com\u002Ffruitcake\u002Fphp-cors for Laravel\n\n## Note for users upgrading to Laravel 9, 10 or higher\n### This package is deprecated because all supported Laravel versions now include the CORS middleware in the core.\n\nSince Laravel 9.2, this Middleware is included in laravel\u002Fframework. You can use the provided middleware, which should be compatible with the Middleware and config provided in this package. See https:\u002F\u002Fgithub.com\u002Flaravel\u002Flaravel\u002Fpull\u002F5825\u002Ffiles for the changes.\n\nSteps to upgrade:\n 1. Remove `\"fruitcake\u002Flaravel-cors\"` from your composer.json\n 2. Replace `\\Fruitcake\\Cors\\HandleCors::class,` with `\\Illuminate\\Http\\Middleware\\HandleCors::class,` in `app\u002FHttp\u002FKernel.php`\n\nSee `https:\u002F\u002Fgithub.com\u002Ffruitcake\u002Fphp-cors` for advanced usage. The config stays the same.\n\n## About\n\nThe `laravel-cors` package allows you to send [Cross-Origin Resource Sharing](http:\u002F\u002Fenable-cors.org\u002F)\nheaders with Laravel middleware configuration.\n\nIf you want to have a global overview of CORS workflow, you can  browse\nthis [image](http:\u002F\u002Fwww.html5rocks.com\u002Fstatic\u002Fimages\u002Fcors_server_flowchart.png).\n\n## Upgrading from 0.x (barryvdh\u002Flaravel-cors)\nWhen upgrading from 0.x versions, there are some breaking changes:\n - **A new 'paths' property is used to enable\u002Fdisable CORS on certain routes. This is empty by default, so fill it correctly!**\n - **Group middleware is no longer supported, use the global middleware**\n - The vendor name has changed (see installation\u002Fusage)\n - The casing on the props in `cors.php` has changed from camelCase to snake_case, so if you already have a `cors.php` file you will need to update the props in there to match the new casing.\n\n## Features\n\n* Handles CORS pre-flight OPTIONS requests\n* Adds CORS headers to your responses\n* Match routes to only add CORS to certain Requests\n\n## Installation\n\nRequire the `fruitcake\u002Flaravel-cors` package in your `composer.json` and update your dependencies:\n```sh\ncomposer require fruitcake\u002Flaravel-cors\n```\n\nIf you get a conflict, this could be because an older version of barryvdh\u002Flaravel-cors or fruitcake\u002Flaravel-cors is installed. Remove the conflicting package first, then try install again:\n\n```sh\ncomposer remove barryvdh\u002Flaravel-cors fruitcake\u002Flaravel-cors\ncomposer require fruitcake\u002Flaravel-cors\n```\n\n## Global usage\n\nTo allow CORS for all your routes, add the `HandleCors` middleware at the top of the `$middleware` property of  `app\u002FHttp\u002FKernel.php` class:\n\n```php\nprotected $middleware = [\n  \\Fruitcake\\Cors\\HandleCors::class,\n    \u002F\u002F ...\n];\n```\n\nNow update the config to define the paths you want to run the CORS service on, (see Configuration below):\n\n```php\n'paths' => ['api\u002F*'],\n```\n\n## Configuration\n\nThe defaults are set in `config\u002Fcors.php`. Publish the config to copy the file to your own config:\n```sh\nphp artisan vendor:publish --tag=\"cors\"\n```\n> **Note:** When using custom headers, like `X-Auth-Token` or `X-Requested-With`, you must set the `allowed_headers` to include those headers. You can also set it to `['*']` to allow all custom headers.\n\n> **Note:** If you are explicitly whitelisting headers, you must include `Origin` or requests will fail to be recognized as CORS.\n\n\n### Options\n\n| Option                   | Description                                                              | Default value |\n|--------------------------|--------------------------------------------------------------------------|---------------|\n| paths                    | You can enable CORS for 1 or multiple paths, eg. `['api\u002F*'] `            | `[]`          |\n| allowed_methods          | Matches the request method.                                              | `['*']`       |\n| allowed_origins          | Matches the request origin. Wildcards can be used, eg. `*.mydomain.com` or `mydomain.com:*`  | `['*']`       |\n| allowed_origins_patterns | Matches the request origin with `preg_match`.                            | `[]`          |\n| allowed_headers          | Sets the Access-Control-Allow-Headers response header.                   | `['*']`       |\n| exposed_headers          | Sets the Access-Control-Expose-Headers response header.                  | `[]`       |\n| max_age                  | Sets the Access-Control-Max-Age response header.                         | `0`           |\n| supports_credentials     | Sets the Access-Control-Allow-Credentials header.                        | `false`       |\n\n\n`allowed_origins`, `allowed_headers` and `allowed_methods` can be set to `['*']` to accept any value.\n\n> **Note:** For `allowed_origins` you must include the scheme when not using a wildcard, eg. `['http:\u002F\u002Fexample.com', 'https:\u002F\u002Fexample.com']`. You must also take into account that the scheme will be present when using `allowed_origins_patterns`.\n\n> **Note:** Try to be as specific as possible. You can start developing with loose constraints, but it's better to be as strict as possible!\n\n> **Note:** Because of [http method overriding](http:\u002F\u002Fsymfony.com\u002Fdoc\u002Fcurrent\u002Freference\u002Fconfiguration\u002Fframework.html#http-method-override) in Laravel, allowing POST methods will also enable the API users to perform PUT and DELETE requests as well.\n\n> **Note:** Sometimes it's necessary to specify the port _(when you're coding your app in a local environment for example)_. You can specify the port or using a wildcard here too, eg. `localhost:3000`, `localhost:*` or even using a FQDN `app.mydomain.com:8080`\n\n### Lumen\n\nOn Lumen, just register the ServiceProvider manually in your `bootstrap\u002Fapp.php` file:\n\n```php\n$app->register(Fruitcake\\Cors\\CorsServiceProvider::class);\n```\n\nAlso copy the [cors.php](https:\u002F\u002Fgithub.com\u002Ffruitcake\u002Flaravel-cors\u002Fblob\u002Fmaster\u002Fconfig\u002Fcors.php) config file to `config\u002Fcors.php` and put it into action:\n\n```php\n$app->configure('cors');\n```\n\n## Global usage for Lumen\n\nTo allow CORS for all your routes, add the `HandleCors` middleware to the global middleware and set the `paths` property in the config.\n\n```php\n$app->middleware([\n    \u002F\u002F ...\n    Fruitcake\\Cors\\HandleCors::class,\n]);\n```\n\n## Common problems\n\n### Wrong config\n\nMake sure the `path` option in the config is correct and actually matches the route you are using. Remember to clear the config cache as well.\n\n### Error handling, Middleware order\n\nSometimes errors\u002Fmiddleware that return own responses can prevent the CORS Middleware from being run. Try changing the order of the Middleware and make sure it's the first entry in the global middleware, not a route group. Also check your logs for actual errors, because without CORS, the errors will be swallowed by the browser, only showing CORS errors. Also try running it without CORS to make sure it actually works.\n\n### Authorization headers \u002F Credentials\n\nIf your Request includes an Authorization header or uses Credentials mode, set the `supports_credentials` value in the config to true. This will set the [Access-Control-Allow-Credentials](https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FHTTP\u002FHeaders\u002FAccess-Control-Allow-Credentials) Header to `true`.\n\n### Echo\u002Fdie\n\nIf you use `echo()`, `dd()`, `die()`, `exit()`, `dump()` etc in your code, you will break the Middleware flow. When output is sent before headers, CORS cannot be added. When the script exits before the CORS middleware finishes, CORS headers will not be added. Always return a proper response or throw an Exception.\n\n### Disabling CSRF protection for your API\n\nIf possible, use a route group with CSRF protection disabled.\nOtherwise you can disable CSRF for certain requests in `App\\Http\\Middleware\\VerifyCsrfToken`:\n\n```php\nprotected $except = [\n    'api\u002F*',\n    'sub.domain.zone' => [\n      'prefix\u002F*'\n    ],\n];\n```\n\n### Duplicate headers\nThe CORS Middleware should be the only place you add these headers. If you also add headers in .htaccess, nginx or your index.php file, you will get duplicate headers and unexpected results.\n\n### No Cross-Site requests\nIf you are not doing Cross-Site requests, meaning if you are not requesting site-a.com\u002Fapi from site-b.com, your browser will not send the `Origin: https:\u002F\u002Fsite-b.com` request header, CORS will be \"disabled\" as the `Access-Control-Allow-Origin` header will be also missing. This happens because requests are being dispatched from the same and no protection is needed in this case.\n\n## License\n\nReleased under the MIT License, see [LICENSE](LICENSE).\n\n[ico-version]: https:\u002F\u002Fimg.shields.io\u002Fpackagist\u002Fv\u002Ffruitcake\u002Flaravel-cors.svg?style=flat-square\n[ico-license]: https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Flicense-MIT-brightgreen.svg?style=flat-square\n[ico-actions]: https:\u002F\u002Fgithub.com\u002Ffruitcake\u002Flaravel-cors\u002Factions\u002Fworkflows\u002Frun-tests.yml\u002Fbadge.svg\n[ico-scrutinizer]: https:\u002F\u002Fimg.shields.io\u002Fscrutinizer\u002Fcoverage\u002Fg\u002Ffruitcake\u002Flaravel-cors.svg?style=flat-square\n[ico-code-quality]: https:\u002F\u002Fimg.shields.io\u002Fscrutinizer\u002Fg\u002Ffruitcake\u002Flaravel-cors.svg?style=flat-square\n[ico-downloads]: https:\u002F\u002Fimg.shields.io\u002Fpackagist\u002Fdt\u002Ffruitcake\u002Flaravel-cors.svg?style=flat-square\n\n[link-packagist]: https:\u002F\u002Fpackagist.org\u002Fpackages\u002Ffruitcake\u002Flaravel-cors\n[link-actions]: https:\u002F\u002Fgithub.com\u002Ffruitcake\u002Flaravel-cors\u002Factions\n[link-scrutinizer]: https:\u002F\u002Fscrutinizer-ci.com\u002Fg\u002Ffruitcake\u002Flaravel-cors\u002Fcode-structure\n[link-code-quality]: https:\u002F\u002Fscrutinizer-ci.com\u002Fg\u002Ffruitcake\u002Flaravel-cors\n[link-downloads]: https:\u002F\u002Fpackagist.org\u002Fpackages\u002Ffruitcake\u002Flaravel-cors\n[link-author]: https:\u002F\u002Fgithub.com\u002Ffruitcake\n[link-contributors]: ..\u002F..\u002Fcontributors\n","fruitcake\u002Flaravel-cors 是一个为 Laravel 应用添加 CORS（跨源资源共享）头支持的 PHP 包。它通过中间件处理预检 OPTIONS 请求，并为响应添加必要的 CORS 头，同时支持根据路由匹配来控制哪些请求需要添加 CORS 头。该包适用于需要在 Laravel 项目中实现跨域资源共享功能的场景，特别适合那些需要与外部服务进行交互的应用。不过需要注意的是，自 Laravel 9.2 起，核心框架已经内置了类似的 CORS 中间件功能，因此对于较新版本的 Laravel 用户来说，建议直接使用框架自带的功能。",2,"2026-06-11 03:17:13","top_language"]