Laravel CORS

fruitcake/laravel-cors is a Laravel package that implements Cross-Origin Resource Sharing (CORS) as HTTP middleware. It wraps the fruitcake/php-cors library and integrates it with Laravel’s request lifecycle, automatically adding the appropriate CORS headers to responses and answering browser preflight (OPTIONS) requests based on a publishable configuration file.

Note that as of Laravel 9.2 this functionality is included in the framework core via Illuminate\Http\Middleware\HandleCors, and this package is now deprecated in favor of the built-in middleware. It remains widely used in older Laravel applications and documents a clear upgrade path.

What You Get

• A HandleCors middleware for Laravel’s HTTP kernel
• A publishable cors.php configuration file
• Automatic preflight (OPTIONS) request handling
• Fine-grained control over allowed origins, methods, and headers
• Support for credentials and exposed headers
• A documented upgrade path to Laravel’s built-in CORS middleware

Common Use Cases

• Allowing a single-page app on another domain to call a Laravel API
• Enabling cross-origin requests for a mobile or third-party client
• Restricting which origins may access specific API routes
• Adding CORS support to older Laravel apps predating built-in support

Under The Hood

Architecture - The package is intentionally tiny: src/CorsServiceProvider.php registers configuration and the CORS handler, and src/HandleCors.php is the middleware that intercepts requests, short-circuits preflight OPTIONS requests, and decorates responses with CORS headers. The actual header logic is delegated to the standalone fruitcake/php-cors library, keeping the Laravel adapter thin. Tech Stack - PHP built on the Laravel/Illuminate contracts and fruitcake/php-cors, distributed under the MIT license and wired via a config file (cors.php) that mirrors php-cors options. Code Quality - A mature, stable codebase with 34 releases and CI, though it is now in maintenance-only status and marked deprecated because Laravel bundles equivalent middleware. API Design - Setup is minimal and declarative: register the middleware in the HTTP kernel and edit the published config; the runtime API surface for application code is effectively zero, which is exactly what a CORS middleware should be.