Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.
One of my Laravel API routes redirects in the browser to HTTP with a 301 redirect, while none of the other 30+ routes do. The route also works on all pages except for this one, which has nothing special about it other than using a Vue Pinia store. Other API routes work on this page.
I tried forcing HTTPS redirect in my AppProvider boot() method, but it still attempts to redirect and says the HTTPS version is not available, therefore enforcing CORS and not allowing the Vue component to render.
"Mixed Content: The page at link_not_allowed was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint link_not_allowed. This request has been blocked; the content must be served over HTTPS."
Works perfectly on local server, but not production.
Is this expected behavior for something I am missing in Laravel? I've never seen it before. Help would be appreciated.
@maq32 I don't know if it's a similar scenario as the issue I had recently when I first tried using Inertia.. but have a look at https://laracasts.com/discuss/channels/vite/laravel-10-inertia-vite-behind-nginx-proxy-in-docker-container-typeerror
I don't know how you're enforcing HTTPS in your Service Provider, but I used the way I had always done for years which works fine for standard Laravel + Blade (and Livewire) applications, but the moment I introduced Inertia, it wasn't enough.
@ian_h thank you for your response, but I think it's a different issue. I enforced HTTPS the same way you did in /Providers/AppProvider.
The issue occurs on local too, but local doesn't seem to have the same CORS restriction, so it calls the endpoint redirect and gets it via HTTP. Production does not do this.
BUMP. Still an issue. Why is this one route not serving over HTTPS? Nothing is different about the api.php route or the controller.
Please or to participate in this conversation.