title: Access to XMLHttpRequest at 'production_api_url' from origin 'localhost' has been blocked by CORS policy
body: <p>I am working on a project which build a website by using Angular 2 as frontend and Laravel 5.7. In the website, I am trying to implement a user profile section like, login, signup, password reset, forgot password, profile view, edit profile. I am written all the apis needed for the user profile section and tested it in the POSTMAN and everything become fine. But, when I am trying to implement the apis which needs the api token, there I got this error </p>
  
  <blockquote>
    <p>Access to XMLHttpRequest at '<a href="http://www.peterbookhouse.com/vibes/backend/public/api/changePassword" rel="nofollow noreferrer">http://www.peterbookhouse.com/vibes/backend/public/api/changePassword</a>' from origin '<a href="http://localhost:4200" rel="nofollow noreferrer">http://localhost:4200</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status."</p>
  </blockquote>
  
  <p>I can't find a solution for this. Please help me to find a solution for this issue. </p>
  
  <p>Thanks in advance</p>
  
  <p>I already created middleware for CORS and added that middleware for the routes which needs. </p>
  
  <p>I tried two different codes in the middleware. I here pasting those codes.</p>
  
  <p>1.</p>
  
  <pre><code>return $next($request)
      -&gt;header(‘Access-Control-Allow-Origin’, ‘*’)
      -&gt;header(‘Access-Control-Allow-Methods’, ‘GET, POST, PUT, DELETE, OPTIONS’)
      -&gt;header(‘Access-Control-Allow-Headers’, ‘X-Requested-With, Content-Type, X-Token-Auth, Authorization’);
  </code></pre>
  
  <p>2.</p>
  
  <pre><code>header("Access-Control-Allow-Origin: *");
  
      // ALLOW OPTIONS METHOD
      $headers = [
          'Access-Control-Allow-Methods'=&gt; 'POST, GET, OPTIONS, PUT, DELETE',
          'Access-Control-Allow-Headers'=&gt; 'Content-Type, X-Auth-Token, Origin, Authorization'
      ];
  
  
  if($request-&gt;getMethod() == "OPTIONS") {
      // The client-side application can set only headers allowed in Access-Control-Allow-Headers
      return Response::make('OK', 200, $headers);
  }
  
  $response = $next($request);
  foreach($headers as $key =&gt; $value)
      $response-&gt;header($key, $value);
  return $response;
  </code></pre>