CORS controls which origins browsers allow — configure correctly or browsers block all cross-origin requests.
Cross-Origin Resource Sharing (CORS)
# FastAPI CORS middleware
from fastapi.middleware.cors import CORSMiddleware
app.add_middleware(
CORSMiddleware,
allow_origins=["https://myapp.com"],
allow_credentials=True,
allow_methods=["GET","POST","PUT","DELETE","PATCH"],
allow_headers=["Authorization","Content-Type"],
max_age=86400,
)
# Laravel cors.php
"allowed_origins" => ["https://myapp.com"],
"allowed_methods" => ["GET","POST","PUT","DELETE"],
# NEVER: allow_origins=["*"] with allow_credentials=True