title: Laravel 7 Passport : blocked by CORS policy
body: <p>When I make the following <strong>axios</strong> request to my <strong>Laravel 7.3 Passport</strong> API:</p>
  
  <pre><code>let url = 'http://laravel.test/oauth/token'
  
  let params = {
    client_id:  4,
    client_secret: 'FBkMiLI8ecdb4A8OhLRDGS1SasZP5NT7i9Qpp7bP',
    grant_type: 'password',
    username: 'me@home.com',
    password: '1qaz@WSX',
    scope: '*'
  }
  
  let headers = {
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'HEAD, GET, POST, PUT, PATCH, DELETE, OPTIONS',
      'Access-Control-Allow-Headers': 'Content-Type'
    }
  
  axios.post(url, params, headers)
  .then(response =&gt; {
        this.access_token = response['data']['access_token'];
        this.get_users_data()
    })
  .catch(response =&gt; {
  // eslint-disable-next-line
      console.log(response)
  });
  </code></pre>
  
  <p>I get this error in my javascript console:</p>
  
  <blockquote>
    <p>Access to XMLHttpRequest at '<a href="http://laravel.test/oauth/token" rel="nofollow noreferrer">http://laravel.test/oauth/token</a>' from
    origin '<a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>' has been blocked by CORS policy:
    Response to preflight request doesn't pass access control check: No
    'Access-Control-Allow-Origin' header is present on the requested
    resource.</p>
  </blockquote>
  
  <p>Also, <code>config/cors.php</code> in Laravel 7.3 is configured to allow anything (by default):</p>
  
  <pre><code>&lt;?php
  
  return [
  
      /*
      |--------------------------------------------------------------------------
      | Cross-Origin Resource Sharing (CORS) Configuration
      |--------------------------------------------------------------------------
      |
      | Here you may configure your settings for cross-origin resource sharing
      | or "CORS". This determines what cross-origin operations may execute
      | in web browsers. You are free to adjust these settings as needed.
      |
      | To learn more: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
      |
      */
  
      'paths' =&gt; ['api/*'],
  
      'allowed_methods' =&gt; ['*'],
  
      'allowed_origins' =&gt; ['*'],
  
      'allowed_origins_patterns' =&gt; [],
  
      'allowed_headers' =&gt; ['*'],
  
      'exposed_headers' =&gt; [],
  
      'max_age' =&gt; 0,
  
      'supports_credentials' =&gt; false,
  
  ];
  </code></pre>
  
  <p>What's wrong in my request ?</p>