@socieboy yes it seems

By the way are you aware that Guzzle can stream the response? http://docs.guzzlephp.org/en/latest/psr7.html#streams

I notice that but I want to let this for a second choise if I can't make it work directly from the browser to the API

i use this https://gist.github.com/jimmyrolando/c67ebe49731edb0383a6e00d9467552f as global middleware, and work fine!

how to solve it??I have the same problem

This is how I fixed it

In Vue.js I added this http option:

Vue.http.options.emulateJSON = true

In PHP I added these headers:

header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept');
header('Access-Control-Allow-Methods: GET, POST, PUT');

I have the same issue. Tried lots of things. The following ajax calls works fine:

$.ajax({
            url: 'https://openiban.com/validate/DE89370400440532013000',    
            data: { // pass additional options
                "validateBankCode": true,   // (not guaranteed)
                "getBIC": true          // (not guaranteed)
            },
            success: function (data) {
                console.log(data);
            },
            error: function (xhr) {
                return xhr;
                // handle error
            }
        });

But when create a vue resource route. I get the following error:

Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

validateIban: function (){
                this.$http.get('https://openiban.com/validate/RANDOMIBAN?getBIC=true&validateBankCode=true')
                    .then(function (response) {

                    console.log(response)

                }, function (error) {
                    this.error = error.data;
                    console.log(error.data);
                });
            },

Wel I have found the solution. Seems the preflight message was caused by Echo (Broadcast) which was appending a Pusher token every request.. This openiban validator did not like that.

Solution:

Vue.http.interceptors.push(function (request, next) {

    //some api's dont like the X-CSFR-token or Pusher token.. remove it..
    const removeAuthHeaders = request.url.includes("openiban.com");

    request.headers['Access-Control-Allow-Origin'] = '*';

    if (removeAuthHeaders){
        request.headers.delete('Access-Control-Request-Headers')
        request.headers.delete('X-Socket-ID');

    }
    else {
        request.headers.set('X-CSRF-TOKEN', Laravel.csrfToken);
    }
    next();
});

For development mode, this error can be handled though vue.config.js file. Check out this article: How to deal with CORS error on Vue CLI 3?

in the latest video , Jeffery mentioned this

check this