CORE

<?php
/**
 * CORS.php
 * @author     raf <[email protected]>
 * @copyright  Copyright (c) 2015, raf
 */

namespace App\Http\Middleware;


use Closure;
use Illuminate\Http\Response;
use Illuminate\Http\Request;

class CORS {


    public function handle($request, Closure $next)
    {


        if( ! $this->isCorsRequest($request))
        {
            return $next($request);
        }


        if($this->isPreflightRequest($request))
        {
            $status = 204;
            $headers = array(
                'Access-Control-Allow-Origin' => $request->headers->get('Origin'),
                'Access-Control-Allow-Methods'  =>'GET, POST, OPTIONS, PUT, DELETE',
                'Access-Control-Allow-Headers' => 'Origin, Content-Type, Accept, Authorization, X-Requested-with',
                'Access-Control-Allow-Credentials' => 'true',
                'Access-Control-Max-Age' => '360',
            );

            $response = $this->makeResponse(null, $status, $headers);

            return $response;
        }


        $response = $next($request);

        $response->headers->set('Access-Control-Allow-Origin', $request->headers->get('Origin'));
        $response->headers->set('Access-Control-Allow-Credentials', 'true');

        return $response;

    }


    public function isCorsRequest(Request $request)
    {
        return $request->headers->has('Origin');
    }


    public function isPreflightRequest(Request $request)
    {
        return ($request->getMethod() === 'OPTIONS');
    }


    public function makeResponse($content, $status, $headers)
    {
        return Response::create($content, $status, $headers);
    }


}

KARNET

<?php namespace App\Http;

use Illuminate\Foundation\Http\Kernel as HttpKernel;

class Kernel extends HttpKernel {

	/**
	 * The application's global HTTP middleware stack.
	 *
	 * @var array
	 */
	protected $middleware = [
		'Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode',
		'Illuminate\Cookie\Middleware\EncryptCookies',
		'Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse',
		'Illuminate\Session\Middleware\StartSession',
		'Illuminate\View\Middleware\ShareErrorsFromSession',
		// 'App\Http\Middleware\VerifyCsrfToken',
		'App\Http\Middleware\CORS',
		
	];

	/**
	 * The application's route middleware.
	 *
	 * @var array
	 */
	protected $routeMiddleware = [
		'auth' => 'App\Http\Middleware\Authenticate',
		'auth.basic' => 'Illuminate\Auth\Middleware\AuthenticateWithBasicAuth',
		'guest' => 'App\Http\Middleware\RedirectIfAuthenticated',
		'check.permission' => 'App\Http\Middleware\PermissionChecker',
		'check.auth' => 'App\Http\Middleware\AuthChecker'
	];

}

Middle where

Route::group(['middleware' => 'check.permission'], function()
	{
		Route::controller('user', 'UserController');
		Route::controller('category', 'CategoryController');
		Route::controller('account', 'AccountController');
		Route::controller('tweet', 'TweetController');
	});