What's going on with these corsas?

Question

CORS

https://pastebin.com/raw/yhvU8vmz
There is a code, I'm trying to make a request to my server


Nothing works, but everything is ok via

postman Here are the headers that my laravel returns

Where to look, what to think? Tell me please

Answer 1

here

Answer 2

HTTP Server API not Apache by any chance?
It often needs to be forced to enable support for HTTP OPTIONS requests.
Otherwise, the ban will still be at the HTTP server level.
In any case, by logging (logging) requests on the HTTP server and in the API application, you can determine what goes where and who gives the answer.
postman, on the other hand, makes requests directly, and therefore they most likely go through neither as cross-domain

Answer 3

Follow the instructions of the fruitcake/laravel-cors package (former barryvdh/laravel-cors) and everything will be fine.

Answer 4

You need to look at browser devtools, not postman.
what there headings come from the server.
Your error is not with CORS at all, but with CSP (connect-src)

Answer 5

The last lark has a built-in cors, you only need to turn it on. The documentation for migrating to 7.x has a link to instructions.