{"action":"created","issue":{"url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/93","labels_url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/93/labels{/name}","comments_url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/93/comments","events_url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/93/events","html_url":"https://github.com/barryvdh/laravel-cors/pull/93","id":128399422,"number":93,"title":"Default allowedMethods to \"*\"","user":{"login":"adamwathan","id":4323180,"avatar_url":"https://avatars.githubusercontent.com/u/4323180?v=3","gravatar_id":"","url":"https://api.github.com/users/adamwathan","html_url":"https://github.com/adamwathan","followers_url":"https://api.github.com/users/adamwathan/followers","following_url":"https://api.github.com/users/adamwathan/following{/other_user}","gists_url":"https://api.github.com/users/adamwathan/gists{/gist_id}","starred_url":"https://api.github.com/users/adamwathan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adamwathan/subscriptions","organizations_url":"https://api.github.com/users/adamwathan/orgs","repos_url":"https://api.github.com/users/adamwathan/repos","events_url":"https://api.github.com/users/adamwathan/events{/privacy}","received_events_url":"https://api.github.com/users/adamwathan/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-24T14:16:06Z","updated_at":"2016-01-24T14:34:42Z","closed_at":"2016-01-24T14:34:37Z","pull_request":{"url":"https://api.github.com/repos/barryvdh/laravel-cors/pulls/93","html_url":"https://github.com/barryvdh/laravel-cors/pull/93","diff_url":"https://github.com/barryvdh/laravel-cors/pull/93.diff","patch_url":"https://github.com/barryvdh/laravel-cors/pull/93.patch"},"body":"Currently, if you provide a list of allowed methods, all of those methods are _always_ returned as allowed in response to the preflight request.\r\n\r\nThis means that if you had a DELETE route and POST route with the same endpoint, but you only wanted the POST route to support CORS, the preflight request would come back and say that DELETE was supported as well, even though it is not.\r\n\r\n`*` on the other hand only includes the requested method in the response, as you can see here:\r\n\r\nhttps://github.com/asm89/stack-cors/blob/master/src/Asm89/Stack/CorsService.php#L114-L117\r\n\r\nThis in combination with #92 means if you had a setup like this:\r\n\r\n```\r\nRoute::delete('my-route', 'Controller@action');\r\n\r\nRoute::group(['middleware' => ['cors']], function () {\r\n    Route::post('my-route', 'Controller@action');\r\n});\r\n```\r\n\r\n...a preflight request for the DELETE endpoint would disallow CORS entirely, and a preflight request for the POST endpoint would set the `Access-Control-Allow-Methods` header to just `POST`, rather than `GET, POST, PUT, DELETE` like the current default would.\r\n\r\nOverall using \"*\" as the default setting actually tightens up the CORS restrictions and allows things to behave in a more automatic way, so you don't even have to worry about configuring which methods are allowed and in conjuction with #92, it will all be done automatically based on the routes you've added the `cors` middleware to."},"comment":{"url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/comments/174303684","html_url":"https://github.com/barryvdh/laravel-cors/pull/93#issuecomment-174303684","issue_url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/93","id":174303684,"user":{"login":"barryvdh","id":973269,"avatar_url":"https://avatars.githubusercontent.com/u/973269?v=3","gravatar_id":"","url":"https://api.github.com/users/barryvdh","html_url":"https://github.com/barryvdh","followers_url":"https://api.github.com/users/barryvdh/followers","following_url":"https://api.github.com/users/barryvdh/following{/other_user}","gists_url":"https://api.github.com/users/barryvdh/gists{/gist_id}","starred_url":"https://api.github.com/users/barryvdh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/barryvdh/subscriptions","organizations_url":"https://api.github.com/users/barryvdh/orgs","repos_url":"https://api.github.com/users/barryvdh/repos","events_url":"https://api.github.com/users/barryvdh/events{/privacy}","received_events_url":"https://api.github.com/users/barryvdh/received_events","type":"User","site_admin":false},"created_at":"2016-01-24T14:34:42Z","updated_at":"2016-01-24T14:34:42Z","body":"Thanks!"}}