If your Laravel API works in Postman but fails in the browser with a CORS policy error, you're dealing with one of the most common issues in modern web development.

You may see an error like:

Access to fetch at 'https://api.example.com/api/users' from origin 'https://example.com' has been blocked by CORS policy.

or

No 'Access-Control-Allow-Origin' header is present on the requested resource.

This guide explains what causes the error and how to fix it in Laravel.

What Is a CORS Error?

CORS (Cross-Origin Resource Sharing) is a browser security feature.

It prevents JavaScript running on one domain from accessing resources on another domain unless the server explicitly allows it.

Example:

Frontend:

https://frontend.example.co

Laravel API:

https://api.example.com

Since these are different origins, the browser checks whether the API allows the request.

If it doesn't, the request is blocked.

Step 1: Verify Your Laravel Version

Laravel 7+ includes built-in CORS support through the fruitcake/laravel-cors package (or native integration in newer versions).

Check your configuration:

config/cors.php

If this file doesn't exist, publish the configuration:

php artisan config:publish cors

Step 2: Configure Allowed Origins

Open:

config/cors.php

Example:

'allowed_origins' => [
    'https://frontend.example.com',
],

For local development:

'allowed_origins' => [
    'http://localhost:3000',
    'http://127.0.0.1:5173',
],

Avoid using:

'*'

in production unless your API is intentionally public.

Step 3: Configure Allowed Paths

Ensure your API routes are included.

Example:

'paths' => [
    'api/*',
    'sanctum/csrf-cookie',
],

If your endpoint isn't covered, Laravel won't return CORS headers.

Step 4: Allow Required HTTP Methods

Most applications need:

'allowed_methods' => ['*'],

or

'allowed_methods' => [
    'GET',
    'POST',
    'PUT',
    'PATCH',
    'DELETE',
],

Step 5: Configure Allowed Headers

A common configuration is:

'allowed_headers' => ['*'],

If your frontend sends custom headers such as:

Authorization
Content-Type
Accept

make sure they're allowed.

Step 6: Check Credentials Configuration

If you're using:

  • Laravel Sanctum

  • Authentication cookies

  • Sessions

you'll need:

'supports_credentials' => true,

Also configure your frontend.

Axios example:

axios.defaults.withCredentials = true;

Fetch example:

fetch(url, {
    credentials: 'include'
});

Step 7: Clear Laravel Configuration Cache

After updating CORS settings, run:

php artisan optimize:clear

Then:

php artisan optimize

Without clearing the cache, Laravel may continue using the old configuration.

Step 8: Check Your Web Server

Sometimes Apache or Nginx removes CORS headers before they reach the browser.

For Nginx, verify that no conflicting configuration overrides the response headers.

For Apache, check:

.htaccess

or your Virtual Host configuration.

Step 9: Verify Preflight (OPTIONS) Requests

Browsers often send an OPTIONS request before the actual API request.

If your server returns:

405 Method Not Allowed

or

404 Not Found

the browser blocks the request before Laravel processes it.

Use your browser's Developer Tools → Network tab to inspect the OPTIONS request.

Step 10: Check Reverse Proxies and Cloudflare

If your application is behind:

  • Cloudflare

  • AWS Load Balancer

  • Nginx Proxy Manager

  • Reverse Proxy

ensure they aren't stripping response headers.

Your API response should include headers similar to:

Access-Control-Allow-Origin: https://frontend.example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Authorization, Content-Type

Common Laravel CORS Problems

API Works in Postman but Not in Browser

Postman ignores browser CORS restrictions.

If Postman succeeds but the browser fails, the issue is almost always CORS configuration.

React or Vue Cannot Access Laravel API

Verify that:

  • Frontend URL is listed in allowed_origins

  • Credentials are configured correctly

  • API routes are included in paths

Sanctum Authentication Fails

When using Laravel Sanctum:

  • Enable supports_credentials

  • Configure trusted frontend domains

  • Include sanctum/csrf-cookie in the CORS paths

  • Send requests with credentials enabled

Local Development

Example configuration:

Frontend:

http://localhost:5173

API:

http://127.0.0.1:8000

Both origins should be listed in allowed_origins.

Final Checklist

If your browser shows a Laravel CORS policy error:

✓ Check config/cors.php
✓ Add the correct frontend origin
✓ Verify API paths are included
✓ Allow required methods and headers
✓ Enable credentials if using Sanctum or sessions
✓ Clear Laravel configuration cache
✓ Check OPTIONS requests in DevTools
✓ Verify Apache, Nginx, or reverse proxy configuration

Most Laravel CORS issues are caused by incorrect allowed_origins, cached configuration, or missing support for preflight requests.

If your Laravel API is still blocked by the browser, send me the full CORS error message, your config/cors.php configuration, and your frontend URL. I can help identify the exact cause.