Cfrgtkky

I had a laravel project, when I run php artisan serve, there shows an error in browser:

Failed to load http://127.0.0.1:8000/api/news/get-news-list: Request header field X-CSRF-TOKEN is not allowed by Access-Control-Allow-Headers in preflight response.

my code is like following:

axios.get(domainName+'/api/news/get-news-list').then(response=>{

    news = response.data.list;

}).catch(function (error) {

    console.log(error);

});

And I already add middleware like following:

Kernel.php

protected $middleware = [

    AppHttpMiddlewareCors::class

];



protected $routeMiddleware = [

    'cors' => AppHttpMiddlewareCors::class

];

Cors.php

public function handle($request, Closure $next)

{

    return $next($request)

        ->header('Access-Control-Allow-Origin','*')

        ->header('Access-Control-Allow-Methods','GET,POST,PUT,PATCH,DELETE,OPTIONS')

        ->header('Access-Control-Allow-Headers','Content-Type,Authorization');



}

api.php

Route::prefix('news')->group(function () {

    Route::get('get-news-list', 'APINewsController@getList')->middleware('cors');

});

Can anyone tell me how to fix this problem?

Just add x-csrf-token header to allowed list. In your case, it's in Cors.php file, header Access-Control-Allow-Headers.

Access-Control-Allow-Headers controls what headers are allowed in CORS request.