Level 2
The problem is probably in the cors middleware:
protected function addCorsHeaders($request, $response)
{
foreach ([
'Access-Control-Allow-Origin' => '*',
'Access-Control-Max-Age' => (60 * 60 * 24),
'Access-Control-Allow-Headers' => $request->header('Access-Control-Request-Headers'),
'Access-Control-Allow-Methods' => $request->header('Access-Control-Request-Methods')
?: 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS',
'Access-Control-Allow-Credentials' => 'true',
] as $header => $value) {
$response->header($header, $value);
}
return $response;
}