title: Why Laravel middleware works for single routes but not group of routes
body: <p>I have added a CORS middleware and it works fine for single routes :-</p>
  
  <pre><code>Route::get('example', ['middleware' =&gt; 'cors', function(){
      return Response::json(array('name' =&gt; 'Steve Jobs', 'company' =&gt; 'Apple'));
  }]);
  </code></pre>
  
  <p>But when I apply it to group of routes, it gives error in console :-</p>
  
  <pre><code>(index):1 XMLHttpRequest cannot load http://jotdot.mysite.com/api/authenticate. 
  Response to preflight request doesn't pass access control 
  check: No 'Access-Control-Allow-Origin' header is present on 
  the requested  resource. Origin 'http://jotdotfrontend.mysite.com' is
  therefore not allowed access.
  </code></pre>
  
  <p>My group of routes :-</p>
  
  <pre><code>Route::group(['middleware' =&gt; 'cors'], function () {
  Route::group(['prefix' =&gt; 'api'], function()
  {
      Route::resource('authenticate', 'AuthenticateController', ['only' =&gt; ['index']]);
      Route::post('authenticate', 'AuthenticateController@authenticate');
  });
  });
  </code></pre>
  
  <p>Cors.php</p>
  
  <pre><code>class CORS
  {
  /**
   * Handle an incoming request.
   *
   * @param  \Illuminate\Http\Request  $request
   * @param  \Closure  $next
   * @return mixed
   */
  public function handle($request, Closure $next)
  {
      header("Access-Control-Allow-Origin: *");
  
      // ALLOW OPTIONS METHOD
      $headers = [
          'Access-Control-Allow-Methods'=&gt; 'POST, GET, OPTIONS, PUT, DELETE',
          'Access-Control-Allow-Headers'=&gt; 'Content-Type, X-Auth-Token, Origin'
      ];
      if($request-&gt;getMethod() == "OPTIONS") {
          // The client-side application can set only headers allowed in Access-Control-Allow-Headers
          return Response::make('OK', 200, $headers);
      }
  
      $response = $next($request);
      foreach($headers as $key =&gt; $value)
          $response-&gt;header($key, $value);
      return $response;
      return $next($request);
  }
  }
  </code></pre>
  
  <p>I am following <a href="https://scotch.io/tutorials/token-based-authentication-for-angularjs-and-laravel-apps" rel="nofollow">https://scotch.io/tutorials/token-based-authentication-for-angularjs-and-laravel-apps</a> and trying to set up backend and frontend on different domains.</p>
  
  <p>Thanks</p>