[Question] CORS Error on all requests

[jjjrmy]

I setup Laravel Sanctum exactly like the docs say. If I copy the requests out of network tab in Chrome and put them in Postman, then the requests work fine.

Access to fetch at 'https://laravel.test/api/user' from origin 'https://spa.laravel.test' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

[jjjrmy]

I think maybe this is some sort of CORS error due to Laravel Valet's SSL certificate.

[manchenkoff]

Hey @jjjrmy!
I've quickly checked your website with credentials, but I do not see any CORS error.
https://nuxt.likewizard.com (johndoe@example.com, secret)

However, I noticed that the server returns an additional header X-Csrf-Token with some unexpected value. The response to the login request is a 302 redirect, which is not expected for the first attempt. API call from the Nuxt app succeeded in getting a CSRF token to pass it to the server. As far as I remember, 302 could be returned by server if it is not configured with proper middleware for API requests or CSRF token is invalid, both options might be your case.

Nuxt application sends a proper set of headers (xsrf token, origin, referrer) as well as content type, but it would be useful to check the backend configuration, especially the list of the following things:

• session domain in .env file
• allowed origins for sanctum
• auth configuration
• code of the authentication controller (action)

Based on these details, I assume that the backend part is misconfigured and we should focus on fixing it first. Also I would recommend setting up additional logs on the Laravel side to check what is going on when it receives a request from Nuxt.

[jjjrmy]

I'm going to close this issue because it entirely seems like an issue with my local environment and making requests to endpoints with Valet SSL certificates.

[manchenkoff]

@jjjrmy no problem, feel free to re-open it in case of issues related to the package!