Limit API access

@mammadataei

You can try this package. https://github.com/fruitcake/laravel-cors

I'm currently using it.

I setted 'supports_credentials' => false and the 'allowed_origins' => ['...'] to desired domain. Now the server prevents the browser requests from other origins but unfortunately responses to other clients like postman or curl. I want to prevent that.

That is not possible. A request from javascript is a normal http request how every client can do it. So you can't block ips neither blocking any special header because a client like postman can send all this.

protect your backend with authentication and authorisation, so only a user can do what he is allowed to. than it theoretically doesnt matter if he does it via you frontend or something else

/*installation Command*/
composer require barryvdh/laravel-cors	=>	/*v0.11.4*/

/*config/app.php*/ $providers
Barryvdh\Cors\ServiceProvider::class,

/*Publish barryvdh/laravel-cors package file*/
php artisan vendor:publish --provider="Barryvdh\Cors\ServiceProvider"

/*Use CORS Middleware*/	=>	/*app/Http/Kernel.php*/
protected $middlewareGroups = [
    'web' => [
       // ...
    ],

    'api' => [
        'throttle:60,1',
        'bindings',
        \Barryvdh\Cors\HandleCors::class,
    ],
];

protected $routeMiddleware = [        
        'cors' => \Barryvdh\Cors\HandleCors::class,        
];