Laravel 10中CORS策略报错问题求助

遇到的错误 #

从源站'https://admin.dev.mydomain.com'访问'https://member.dev.mydomain.com/members/fernando/basic'的XMLHttpRequest被CORS策略阻止：预检请求的响应未通过访问控制检查：'Access-Control-Allow-Origin'头包含多个值'https://admin.dev.mydomain.com, https://admin.dev.mydomain.work'，但只允许一个值。

当前配置 #

kernel.php配置 #

protected $middleware = [
        \App\Http\Middleware\TrustHosts::class,
        \App\Http\Middleware\TrustProxies::class,
        \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
        \App\Http\Middleware\TrimStrings::class,
        // \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
        // \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
        // \Illuminate\Session\Middleware\StartSession::class,
        // \App\Http\Middleware\PreflightResponse::class,
        \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
        \Illuminate\Http\Middleware\HandleCors::class,
        \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
        //\App\Http\Middleware\EncryptCookies::class,
        //\Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
        \Illuminate\Session\Middleware\StartSession::class,
        //\Illuminate\View\Middleware\ShareErrorsFromSession::class,
        // \Illuminate\Foundation\Http\Middleware\VerifyPostSize::class,
        \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
    ];

config/cors.php配置 #

<?php

return [

    'paths' => ['*'],

    'allowed_methods' => ['*'],

    'allowed_origins' => ['*.dev.mydomain.com'],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => true,
];

问题原因及解决步骤 #

1. 清理重复/过时的Kernel中间件 #

你的$middleware数组存在两个问题：

• 重复注册了PreventRequestsDuringMaintenance::class
• 保留了Laravel 10已弃用的CheckForMaintenanceMode::class
• HandleCors::class位置靠后，可能被其他中间件先输出响应头

修改后的$middleware数组：

protected $middleware = [
    \App\Http\Middleware\TrustHosts::class,
    \App\Http\Middleware\TrustProxies::class,
    \Illuminate\Http\Middleware\HandleCors::class, // 移至靠前位置，优先处理CORS
    \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
    \App\Http\Middleware\TrimStrings::class,
    \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
    \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
    \Illuminate\Session\Middleware\StartSession::class,
];

2. 修正CORS配置的冲突点 #

当supports_credentials设为true时，allowed_origins不能使用泛域名（如*.dev.mydomain.com），必须指定具体域名，否则Laravel会动态匹配多来源导致头信息重复。修改config/cors.php：

'allowed_origins' => [
    'https://admin.dev.mydomain.com',
    'https://admin.dev.mydomain.work',
],

3. 检查服务器层面的CORS配置 #

如果你的服务器（如Nginx）也配置了CORS响应头，会和Laravel的中间件重复输出，导致Access-Control-Allow-Origin出现多个值。需删除服务器配置中的CORS相关add_header规则，让Laravel统一处理跨域。

4. 清空配置缓存 #

修改配置后执行以下命令生效：

php artisan config:clear
php artisan cache:clear

内容的提问来源于stack exchange，提问作者Ashley Mok