Как фиксить No 'Access-Control-Allow-Origin'?

Question

[Alexander]

Пишу SPA приложение. Собрал проект через webpack по оф.доке от angular 2. Отправляю простой post запрос и вот что выводит консоль:

XMLHttpRequest cannot load http://spa.local/api/heroes. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:1313' is therefore not allowed access.
hero.service.ts?e399:46 0 -  {"isTrusted":true}

Создал CORS middleware:

class Cors
{
    public function handle($request, Closure $next)
    {
        return $next($request)
            ->header('Access-Control-Allow-Origin', '*')
            ->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
            ->header('Access-Control-Max-Age', '1000')
            ->header('Access-Control-Allow-Headers', 'Origin, Content-Type, X-Auth-Token');
    }
}

Но ошибка по прежнему таже.
Делаю post запрос через POSTMAN, все нормально, сервер данными отвечает. Заглядываю во вкладку headers:

Access-Control-Allow-Headers →Origin, Content-Type, X-Auth-Token
Access-Control-Allow-Methods →GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin →*
Access-Control-Max-Age →1000
Cache-Control →no-cache, private
Connection →keep-alive
Content-Encoding →gzip
Content-Type →text/html; charset=UTF-8
Date →Mon, 30 Jan 2017 15:03:34 GMT
Server →nginx/1.10.1 (Ubuntu)
Transfer-Encoding →chunked

Так в чем же проблема и куда копать ?

Comments

[emp1re]

cors на сервере настроили?

Answer 1

[Алексей Вардугин]

поставь https://github.com/barryvdh/laravel-cors

или поправь свой middleware:

public function handle($request, Closure $next)
{
      $response = $next($request);

      if ($response instanceof Response) {
          $response->headers->add([
              'Access-Control-Allow-Origin' => '*',
              'Access-Control-Allow-Headers' => 'authorization, allow',
              'Access-Control-Allow-Methods' => 'GET, POST, PUT, DELETE, OPTIONS'
          ]);
      }

      return $response;
}