Laravel 5.3 CORS with JWT auth - php

Question

I have an issue with Laravel 5.3 CORS. I searched a lot on this issue, and found many recommending barryvdh for CORS. This however didn't work, and I found people mentioning that this could be caused by the use of tymondesigns jwt-auth module. Some suggests bypassing it by setting
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Headers: Authorization, Content-Type');
in the api.php file. This results in responses like:
Failed to load https://example.com/api/v1/members/1: Method PUT is not allowed by Access-Control-Allow-Methods in preflight response.
In attempt to resolve this issue I added
header('Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE, PUT');
to the above 2 lines. However this left me with a new issue:
PUT https://example.com/api/v1/members/1 403 (Forbidden)
Failed to load https://example.com/api/v1/members/1: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://example.com' is therefore not allowed access. The response had HTTP status code 403.
Any suggestions how to go about this?

Answer 1

If this is only happening on production, be sure to check your nginx configuration files. This is likely due to the following settings:
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
Try commenting these out to see if that fixes the situation, then un-comment one by one, and make adjustments as necessary.

Answer 2

You can use three-way to solve this problem:
1) Use barrvay/laravel-cors
'supportsCredentials' => false,
'allowedOrigins' => ['http://localhost:4200'],
'allowedHeaders' => ['Content-Type','Accept','Authorization'],
'allowedMethods' => ['GET','POST','PUT', 'PATCH', 'OPTIONS', 'DELETE'],
'exposedHeaders' => ['Content-Disposition', 'x-total-count', 'x-filename'],
'maxAge' => 0,
'hosts' => ['*'],
2) Use Chrome Plugin (Moesif CORS) for localhost
3) Build a CORS middleware and putt all of cors header inside it
namespace App\Http\Middleware;
use Closure;
class Cors {
public function handle($request, Closure $next)
{
return $next($request)
->header('Access-Control-Allow-Origin', '*')
->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
}
}