Why did the CORS problem appear?

Question

htaccess

Hi all! Such a disaster. Initially installed CORS middleware. and added headers to htaccess. Everything worked on a "normal" controller, so to speak. After I decided to optimize and created a resource controller. On LAN, everything worked out the rules, and after, when the transfer to the host, there was a problem with CORS. I can't send a POST request while GET works fine..

<?php

namespace App\Http\Middleware;

use Closure;

class Cors {
    public function handle($request, Closure $next)
    {
        return $next($request)
            ->header('Access-Control-Allow-Origin', 'http://app.bezraboty.by')
            ->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
    }
}

<IfModule mod_rewrite.c>
    RewriteEngine On

    Header set Access-Control-Allow-Origin "*"
    Header set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
    Header set Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept"

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)/$ /$1 [L,R=301]

    # Handle Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

Answer 1

Everything worked fine locally

And locally on different domains tested? Looks like no.
1. Why do you duplicate headers from both Apache and PHP? One is enough (PHP is better)
2. Only one Access-Control-Allow-Origin is enough without the rest
3. Check the returned headers from /cors.txt . At the same time, make sure that they are served immediately, and not redirected to /cors.txt/ .
4. Check your algorithm at https://upload.wikimedia.org/wikipedia/commons/thu...

Answer 2

In general, it was necessary to modify htaccess a little)