danharper/CatchAllOptionsRequestsProvider.php

Register the CatchAllOptionsRequestsProvider service provider in bootstrap/app.php which will check the incoming request and response successfully if it is an OPTIONS request.

Add the CorsMiddleware to the $app->middleware([ array in bootstrap/app.php which will attach the following CORS headers to all responses:

allow all headers
allow requests from all origins
allow all the headers which were provided in the request

porfidev · 2017-05-12T15:38:25Z

@rgehan solutions works perfectly adding a Middleware. Im Working Lumen 5.4 in vhost (custom domain) and consuming via Angular4 (locahost)

===
UPDATE > @rgehan your solution doesn't work on anonymous function - download method

    $app->get('images/covers/{image}', function($image = null){
        $path = storage_path().'/app/covers/';
        if(file_exists($path . $image)){
            return response()->download($path . $image);
        }
    });

kakoma · 2017-07-07T21:47:04Z

Thanks @rgehan. This modification works well

rodralme · 2017-07-28T03:05:05Z

Thanks @rgehan. You save my life.

lazarohcm · 2017-08-15T12:45:49Z

Thank you mate!

I had to change my response headers a little to make it works on here. The allowed headers now looks like this
'Access-Control-Allow-Headers' => 'access-control-allow-origin,authorization,content-type'

vamidi · 2017-08-25T11:44:09Z

Thank you so much this really helped me out!
Don't know if anyone had to do the same thing, but I had to do

$app->options('/card', ['middleware' => 'cors', '']);

$app->post('/card', ['middleware' => 'cors', 'uses' => 'CardController@createCard']);

to make it work maybe I missing a step.

s1728k · 2017-08-30T21:15:52Z

hi thanks

It worked for me.

hi vamidi you need to register the middleware in bootstrap/app.php inside the app->middleware.

this is explained in top post.

s1728k · 2017-09-08T18:13:25Z

hi I worked me for get request but for post request it is not working for me.

s1728k · 2017-09-08T20:21:35Z

hi,

if you are using the IIS server by chance you set the HTTP request headers as below

Access-Control-Allow-Origin:*
Access-Control-Allow-Methods: 'HEAD, GET, POST, PUT, PATCH, DELETE'
Access-Control-Allow-Headers: 'Origin, Content-Type, X-Auth-Token';

then everything works fine.

besabellacyrus · 2017-09-27T02:20:42Z

and now POST 404 not found

bosskmk · 2017-10-07T16:03:57Z

Thank you.

CarlosZM · 2017-10-18T00:32:34Z

Thanks @rgehan. You save my life.
@danharper try to update your solution with the @rgehan given

txan2 · 2017-10-27T07:48:38Z

Thanks @danharper.

I'm still concerned about the usage of Service Provider, isn't it meant to be used for registering things instead of handling things?

saijayaprakash · 2017-11-04T19:26:33Z

Cors middleware is working but catchalloptionsprovider is not working and throwing the following error..Somebody,

please help me!!

ccmelas · 2017-11-19T04:57:04Z

Wow...Finally... Thanks a lot

nusendra · 2017-12-21T02:43:23Z

It works. Thanks
So This is the perfect solution for me

Create CatchAllOptionsRequestsProvider.php to App\Providers folder.

<?php namespace App\Providers;
use Illuminate\Support\ServiceProvider;
/**
 * If the incoming request is an OPTIONS request
 * we will register a handler for the requested route
 */
class CatchAllOptionsRequestsProvider extends ServiceProvider {
  public function register()
  {
    $request = app('request');
    if ($request->isMethod('OPTIONS'))
    {
      app()->options($request->path(), function() { return response('', 200); });
    }
  }
}

Then create CorsMiddleware.php

<?php

namespace App\Http\Middleware;

use Closure;

class CorsMiddleware
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
		//Intercepts OPTIONS requests
		if($request->isMethod('OPTIONS')) {
			$response = response('', 200);
		} else {
			// Pass the request to the next middleware
			$response = $next($request);
		}

		// Adds headers to the response
		$response->header('Access-Control-Allow-Methods', 'HEAD, GET, POST, PUT, PATCH, DELETE');
		$response->header('Access-Control-Allow-Headers', $request->header('Access-Control-Request-Headers'));
		$response->header('Access-Control-Allow-Origin', '*');

		// Sends it
		return $response;
	}
}

In bootstrap/app.php
add this

$app->middleware([
   App\Http\Middleware\CorsMiddleware::class
]);

$app->register(App\Providers\CatchAllOptionsRequestsProvider::class);

Thanks to @danharper and @rgehan

zhacarias · 2017-12-29T08:20:37Z

Thanks a lot mate.. 👍

lmj0011 · 2018-05-05T03:19:03Z

thanks @davidnknight @rgehan

You're right, all of this Middleware logic can be placed just in the middleware file and not also in a ServiceProvider.

ref:

https://gist.github.com/danharper/06d2386f0b826b669552#gistcomment-1694593

https://gist.github.com/danharper/06d2386f0b826b669552#gistcomment-2013919

choyan · 2019-09-07T08:15:49Z

Thanks for summing it up @nusendra

nusendra · 2019-09-08T06:27:12Z

my pleasure bud @choyan

yogenmohara · 2020-02-03T21:24:30Z

Works for me. Many Thanks. :)

skylineCodes · 2020-02-21T10:48:10Z

Thanks very much for this

rulatir · 2020-04-08T10:55:27Z

Could you please explain how this solution can possibly be correct? My understanding is that OPTIONS exists in the HTTP standard for a reason. Carelessly stubbing it to a no-op must eventually have Dire Consequences, right?

seinshah · 2020-06-08T10:44:38Z

My solution was creating CorsMiddleware as below:

<?php

/**
 * Location: /app/Http/Middleware
 */
namespace App\Http\Middleware;

use Closure;

class CorsMiddleware
{
	/**
	 * Handle an incoming request.
	 *
	 * @param  \Illuminate\Http\Request  $request
	 * @param  \Closure  $next
	 * @return mixed
	 */
	public function handle($request, Closure $next)
	{
		$headers = [
			'Access-Control-Allow-Origin' => '*',
			'Access-Control-Allow-Methods' => 'POST,GET,PATCH,PUT,DELETE,OPTIONS',
			'Access-Control-Max-Age' => '86400',
                        'Access-Control-Allow-Headers' => 'Content-Type,API-KEY'
                ];

		if ($request->isMethod('OPTIONS')) {
			return response()->json('', 200, $headers);
		}

		$response = $next($request);

		foreach ($headers as $key => $value) {
			$response->header($key, $value);
		}

		return $response;
	}
}

Then register the middleware with a name in bootstrap/app.php as below:

$app->routeMiddleware([
  'cors' => App\Http\Middleware\CorsMiddleware::class
]);

Then wrapping required routes between the defined middleware in routes/web.php as below, and adding an additional rule to handle preflight OPTIONS requests:

$router->group(['middleware' => 'cors'], function () use ($router) {
  //All the routes you want to allow CORS for

  $router->options('/{any:.*}', function (Request $req) {
    return;
  });
});

NOTE
Using Chrome, you can get a more detailed error message than Firefox, which will help you to fix the problem and exactly states why there is no Access-Control-Allow-Origin in the response header. Also, keep in mind that any kind of redirect is not allowed in the preflight request, so make sure you don't have such rule in your .htaccess or any other place.

JhonLimbong17 · 2020-06-30T09:05:26Z

My solution was creating CorsMiddleware as below:
<?php

/**
 * Location: /app/Http/Middleware
 */
namespace App\Http\Middleware;

use Closure;

class CorsMiddleware
{
	/**
	 * Handle an incoming request.
	 *
	 * @param  \Illuminate\Http\Request  $request
	 * @param  \Closure  $next
	 * @return mixed
	 */
	public function handle($request, Closure $next)
	{
		$headers = [
			'Access-Control-Allow-Origin' => '*',
			'Access-Control-Allow-Methods' => 'POST,GET,PATCH,PUT,DELETE,OPTIONS',
			'Access-Control-Max-Age' => '86400',
                        'Access-Control-Allow-Headers' => 'Content-Type,API-KEY'
                ];

		if ($request->isMethod('OPTIONS')) {
			return response()->json('', 200, $headers);
		}

		$response = $next($request);

		foreach ($headers as $key => $value) {
			$response->header($key, $value);
		}

		return $response;
	}
}
Then register the middleware with a name in bootstrap/app.php as below:
$app->routeMiddleware([
  'cors' => App\Http\Middleware\CorsMiddleware::class
]);
Then wrapping required routes between the defined middleware in routes/web.php as below, and adding an additional rule to handle preflight OPTIONS requests:
$router->group(['middleware' => 'cors'], function () use ($router) {
  //All the routes you want to allow CORS for

  $router->options('/{any:.*}', function (Request $req) {
    return;
  });
});
NOTE
Using Chrome, you can get a more detailed error message than Firefox, which will help you to fix the problem and exactly states why there is no Access-Control-Allow-Origin in the response header. Also, keep in mind that any kind of redirect is not allowed in the preflight request, so make sure you don't have such rule in your .htaccess or any other place.

I've tried all of the code, and LOL, no one work for me.

I'm still got this error

saydin · 2021-08-11T09:05:55Z

saydin · 2021-08-11T09:06:04Z

hello everyone. I have cors middleware in my lumen as above. cors midlleware works normally when i make a request to lumen from my app. however, whenever a function that I need to send mail runs, I get the error "Call to a member function header() on null".

rvalitov · 2021-10-08T01:29:50Z

A single file solution with CorsMiddleware.php worked like a charm with Lumen 8.x. The only issue I had that my .htaccess file was not default and was adjusted with the following command:

RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=200,L]

In my case I had to remove these lines to make things work.

saydin · 2021-10-08T06:05:16Z

Hello everyone again. I solved my error related to this issue. I share my answer with you below.

Due to the middleware structure, it returns and switches to the next request after processing. If an error is encountered after the request middleware has passed and did not return, the return value will be null.

For example, after I pass the request from the cors middleware, I am sending a mail via a event as a result of a series of operations. However, even though I changed the mail blade I sent, the cors middleware response value returns null because the php document created in ~/storage/framework/views does not update, and an error occurs.

https://stackoverflow.com/questions/68739232/call-to-a-member-function-header-on-null-in-cors-middleware-in-lumen/68760328#68760328

	<?php namespace App\Providers;

	use Illuminate\Support\ServiceProvider;

	/**
	* If the incoming request is an OPTIONS request
	* we will register a handler for the requested route
	*/
	class CatchAllOptionsRequestsProvider extends ServiceProvider {

	public function register()
	{
	$request = app('request');

	if ($request->isMethod('OPTIONS'))
	{
	app()->options($request->path(), function() { return response('', 200); });
	}
	}

	}

	<?php namespace App\Http\Middleware;

	class CorsMiddleware {

	public function handle($request, \Closure $next)
	{
	$response = $next($request);

	$response->header('Access-Control-Allow-Methods', 'HEAD, GET, POST, PUT, PATCH, DELETE');
	$response->header('Access-Control-Allow-Headers', $request->header('Access-Control-Request-Headers'));
	$response->header('Access-Control-Allow-Origin', '*');

	return $response;
	}

	}

danharper/CatchAllOptionsRequestsProvider.php

porfidev commented May 12, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kakoma commented Jul 7, 2017

Uh oh!

rodralme commented Jul 28, 2017

Uh oh!

lazarohcm commented Aug 15, 2017

Uh oh!

vamidi commented Aug 25, 2017

Uh oh!

s1728k commented Aug 30, 2017

Uh oh!

s1728k commented Sep 8, 2017

Uh oh!

s1728k commented Sep 8, 2017

Uh oh!

besabellacyrus commented Sep 27, 2017

Uh oh!

bosskmk commented Oct 7, 2017

Uh oh!

CarlosZM commented Oct 18, 2017

Uh oh!

txan2 commented Oct 27, 2017

Uh oh!

saijayaprakash commented Nov 4, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ccmelas commented Nov 19, 2017

Uh oh!

nusendra commented Dec 21, 2017

Uh oh!

zhacarias commented Dec 29, 2017

Uh oh!

lmj0011 commented May 5, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

choyan commented Sep 7, 2019

Uh oh!

nusendra commented Sep 8, 2019

Uh oh!

yogenmohara commented Feb 3, 2020

Uh oh!

skylineCodes commented Feb 21, 2020

Uh oh!

rulatir commented Apr 8, 2020

Uh oh!

seinshah commented Jun 8, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JhonLimbong17 commented Jun 30, 2020

Uh oh!

saydin commented Aug 11, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

saydin commented Aug 11, 2021

Uh oh!

rvalitov commented Oct 8, 2021

Uh oh!

saydin commented Oct 8, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

porfidev commented May 12, 2017 •

edited

Loading

saijayaprakash commented Nov 4, 2017 •

edited

Loading

lmj0011 commented May 5, 2018 •

edited

Loading

seinshah commented Jun 8, 2020 •

edited

Loading

saydin commented Aug 11, 2021 •

edited

Loading

saydin commented Oct 8, 2021 •

edited

Loading