CORS with Laravel 4

Question

I am writing an API, and using Laravel 4 to achieve that. My api is at a different domain. lets assume that it is: http://api-example.com/

And when i try to make ajax requests via Backbone to my api from my web-app (i.e mydomain.com) with basic authentication, it sometimes works just fine, but sometimes it doesn't. I am trying to figure out why. Below are my App::before filter and App::after filter.

App::before(function($request)
{
    if($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
        $statusCode = 204;

        $headers = [
            'Access-Control-Allow-Origin'      => 'http://mydomain.com',
            'Allow'                            => 'GET, POST, OPTIONS',
            'Access-Control-Allow-Headers'     => 'Origin, Content-Type, Accept, Authorization, X-Requested-With',
            'Access-Control-Allow-Credentials' => 'true'
        ];

        return Response::make(null, $statusCode, $headers);
    }
});

And my after filter:

App::after(function($request, $response)
{
    $response->headers->set('Access-Control-Allow-Origin', 'http://mydomain.com');
    $response->headers->set('Allow', 'GET, POST, OPTIONS');
    $response->headers->set('Access-Control-Allow-Headers', 'Origin, Content-Type, Accept, Authorization, X-Requested-With');
    $response->headers->set('Access-Control-Allow-Credentials', 'true');
    return $response;
});

The thing is when i try to make a post request to /login with the credentials, API checks the db and gets the API key for the user. This is just working fine. But when i try to make a POST request to /users chrome just gives me following error:

XMLHttpRequest cannot load http://api-example.com/users. Origin http://mydomain.com is not allowed by Access-Control-Allow-Origin.

I tried everything, such as setting Access-Control-Allow-Origin to '*' everything i could be able to find from internet. But nothing worked so far. I don't know what i should do.

Answer 1

There is a mistake in the header name.

header('Allow', 'GET, POST, OPTIONS'); // This is wrong.

header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'); // This is right.