What to do with cross-domain request between frontend part (reactJS) and backend part (laravel)?

Question

Laravel

So it goes.
I read some bullshit on google.
I found this solution on a foreign resource: 'header('Access-Control-Allow-Origin: *');and immediately remembered that I did something similar at the very beginning of my web career.
But where should I put this header in Laravel?
And how to properly restrict access to only one domain?

Answer 1

Access-Control-Allow-Origin can only go to a wildcard or a specific domain.
so for the whitelist of domains you need to feint:

SetEnvIf Origin "^http(s)?://(.+\.)?(domain\.org|domain2\.com)$" origin_is=$0 
Header always set Access-Control-Allow-Origin %{origin_is}e env=origin_is