Dauren S

CORS_ALLOWED_ORIGINS = [
    "https://example.com",
    "http://127.0.0.1:8080",
    "http://localhost:8080",
    "http://127.0.0.1:9000"
]
CORS_ALLOW_CREDENTIALS=True

В общем решил так
1) Убрал в Lumen в /bootstrap/app.php middleware Cors,
2) в nginx в site.conf добавил
add_header 'Access-Control-Max-Age' 86400;
add_header 'Access-Control-Allow-Origin' "new.site.kz" always;
add_header 'Access-Control-Allow-Credentials' 'true' always;
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'Accept, Authorization, Cache-Control, Content-Type, Keep-Alive, Origin, User-Agent, X-Requested-With' always;
add_header 'Access-Control-Expose-Headers' 'Authorization, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset' always;