title: Laravel 5.2 CORS, GET not working with preflight OPTIONS
body: <p>The dreaded CORS Error:</p>
  
  <blockquote>
    <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading
    the remote resource at <a href="http://localhost/mysite/api/test">http://localhost/mysite/api/test</a>. (Reason: CORS
    header 'Access-Control-Allow-Origin' missing).</p>
  </blockquote>
  
  <p>Laravel route:</p>
  
  <pre><code>$router-&gt;group(['prefix' =&gt; 'api', 'middleware' =&gt; 'cors'], function ($router) {
      $router-&gt;get('/test', 'MyController@myMethod');
  });
  </code></pre>
  
  <p>Laravel Cors Middlware:</p>
  
  <pre><code>public function handle($request, Closure $next)
      {
          header('Access-Control-Allow-Origin: *');
  
          // ALLOW OPTIONS METHOD
          $headers = [
              'Access-Control-Allow-Methods' =&gt; 'POST, GET, OPTIONS, PUT, DELETE',
              'Access-Control-Allow-Headers' =&gt; 'Content-Type, X-Auth-Token, Origin, Authorization'
          ];
          if ($request-&gt;getMethod() == "OPTIONS") {
              // The client-side application can set only headers allowed in Access-Control-Allow-Headers
              return Response::make('OK', 200, $headers);
          }
  
          $response = $next($request);
          foreach ($headers as $key =&gt; $value)
              $response-&gt;header($key, $value);
          return $response;
      }
  </code></pre>
  
  <p>Laravel Kernel:</p>
  
  <pre><code> protected $routeMiddleware = [
          'auth' =&gt; \App\Http\Middleware\Authenticate::class,
          'auth.basic' =&gt; \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
          'guest' =&gt; \App\Http\Middleware\RedirectIfAuthenticated::class,
          'throttle' =&gt; \Illuminate\Routing\Middleware\ThrottleRequests::class,
          'cors' =&gt; \App\Http\Middleware\CORS::class
      ];
  </code></pre>
  
  <p>Relevant .htaccess:</p>
  
  <pre><code>RewriteCond %{HTTP:Authorization} .
  RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
  </code></pre>
  
  <p>Relevant Vue.js:</p>
  
  <pre><code> new Vue({
          el: '#app',
          data: {
             //data here
          },
          http: {
              headers: {
                  "Authorization": "Basic " + "apiKeyHere"
              }
          },
          methods: {
              mymethod: function (e)
              {
                  e.preventDefault();
                  this.$http.get('http://localhost/mysite/api/test').then(
                          function (response)
                          {
                            //do something
                          }
                  )
              }
          }
      });
  </code></pre>
  
  <p>If I take out the Authorization header option the request works.</p>
  
  <p>I've also tried <a href="https://github.com/barryvdh/laravel-cors">https://github.com/barryvdh/laravel-cors</a> but still no joy.
  Any help appreciated!</p>