Laravel 10子域名React应用CORS问题：登录后路由无法访问

问题场景 #

React应用部署在子域名https://demo.example.xyz，Laravel后端部署在主域名https://example.xyz，登录功能正常，但完成认证后访问/api/admin/dashboard/等路由时，触发CORS拦截错误。

当前配置 #

CORS配置文件（config/cors.php） #

'paths' => ['*', 'sanctum/csrf-cookie'],

'allowed_methods' => ['*'],

'allowed_origins' => ['*'],

'allowed_origins_patterns' => [],

'allowed_headers' => ['*'],

'exposed_headers' => [],

'max_age' => 0,

'supports_credentials' => false,

Kernel配置（app/Http/Kernel.php） #

protected $middleware = [
    // \App\Http\Middleware\TrustHosts::class,
    \App\Http\Middleware\TrustProxies::class,
    \Illuminate\Http\Middleware\HandleCors::class,
    \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
    \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
    \App\Http\Middleware\TrimStrings::class,
    \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
];

错误信息 #

admin:1 Access to XMLHttpRequest at 'https://example.xyz/api/admin/dashboard/' from origin 'https://demo.example.xyz' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.

网络请求信息 #

Request URL: https://example.xyz/api/admin/dashboard/
Referrer Policy: strict-origin-when-cross-origin

解决方案 #

1. 开启跨域凭证支持 #

修改config/cors.php中的supports_credentials为true，Sanctum认证需要跨域携带Cookie：

'supports_credentials' => true,

2. 修复路由重定向问题 #

错误核心是预检OPTIONS请求触发了301/302重定向，解决方式：

• 统一路由格式：如果Laravel路由定义为/api/admin/dashboard，确保前端请求也使用不带末尾斜杠的地址，避免Laravel自动重定向。
• 若用Nginx反向代理，添加配置自动去除URL末尾斜杠：

  rewrite ^/(.*)/$ /$1 permanent;
  

3. 确认CORS中间件优先级 #

保证HandleCors在全局中间件数组最顶部（你的配置已满足，若调整过顺序需重新检查），确保CORS响应头优先设置。

4. 清除配置缓存 #

修改配置后执行以下命令，确保新配置生效：

php artisan config:clear

5. 配置TrustProxies（若使用反向代理） #

如果后端部署在Nginx等代理之后，修改app/Http/Middleware/TrustProxies.php，正确配置代理IP：

protected $proxies = ['*']; // 生产环境建议替换为具体代理IP
protected $headers = Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_HOST | Request::HEADER_X_FORWARDED_PORT | Request::HEADER_X_FORWARDED_PROTO;

内容的提问来源于stack exchange，提问作者Wahidul Alam