CORS | Laravel Documentation

Checks your CORS headers. A server that trusts any origin while allowing credentials lets any website read your users' data.

How it works

Cross-origin resource sharing (CORS) headers decide which other websites may read your responses from a visitor's browser. Once a day, we send a request with a foreign Origin header and check whether your server trusts it.

The dangerous combination is a server that echoes back any origin in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true. With that, any website your users visit can read their data from your site while they are logged in.

We test your monitored URL and, when the API assertion check has an endpoint, that endpoint too.

Statuses

Status	Meaning
OK	Foreign origins are not trusted.
Warning	Any origin may read the responses, without credentials. This is fine for truly public data, risky for anything else.
Failed	Any origin may read the responses with the visitor's credentials.

By default you are notified of warnings and failures.

Fixing common problems

Never reflect the Origin header back as is. Keep a list of the origins you trust and only send those back.
In Laravel, list your front-end origins in allowed_origins in config/cors.php instead of *, and only enable supports_credentials for those.
Public APIs that need no cookies can use Access-Control-Allow-Origin: * without credentials.