How do you configure CORS in config/cors.php and avoid common errors with SPA applications?

Short answer

Specify allowed domains in allowed_origins and enable supports_credentials when the app uses cookies with Sanctum authentication.

Explanation

When a React/Vue app on a separate domain communicates with a Laravel server, browsers block cookies and response access without explicit permission. config/cors.php lets you specify affected paths, allowed domains, sensitive headers, and supports_credentials: true for session-based authentication.

Code example

// config/cors.php
'paths' => ['api/*', 'sanctum/csrf-cookie'],
'allowed_origins' => ['https://my-frontend.com'],
'supports_credentials' => true,

Common mistakes

• Setting allowed_origins: ['*'] along with supports_credentials: true, which browsers prohibit for security.

Follow-up questions

• Compare Laravel Sanctum and Laravel Passport, and when should you choose each one?

Sources

• Laravel docs — CORS configuration