title: CORS request working fine on Chrome but not on Safari/Firefox
body: <p><strong>The Problem</strong></p>
  
  <p>When making a CORS request to login to my app on localhost, I am getting the following error on the latest version of Safari/Firefox running on Sierra.</p>
  
  <p>Doing this exact thing on Chrome however works absolutely fine without any issues. I am using Laravel 5.6+ with CORS enabled properly.</p>
  
  <p><strong>Safari</strong></p>
  
  <p><a href="https://i.stack.imgur.com/dnx6B.png" rel="noreferrer"><img src="https://i.stack.imgur.com/dnx6B.png" alt="enter image description here"></a></p>
  
  <p><strong>Firefox</strong></p>
  
  <p><a href="https://i.stack.imgur.com/STnvA.png" rel="noreferrer"><img src="https://i.stack.imgur.com/STnvA.png" alt="enter image description here"></a></p>
  
  <p><strong>Firefox Network tab</strong></p>
  
  <p><a href="https://i.stack.imgur.com/3hCH0.png" rel="noreferrer"><img src="https://i.stack.imgur.com/3hCH0.png" alt="enter image description here"></a></p>
  
  <p><strong>/login POST OK, /user GET NOPE</strong></p>
  
  <p><a href="https://i.stack.imgur.com/xFyNb.png" rel="noreferrer"><img src="https://i.stack.imgur.com/xFyNb.png" alt="enter image description here"></a></p>
  
  <p><strong>Chrome /user GET (notice Access-Control-Allowed-Origin)</strong></p>
  
  <p><a href="https://i.stack.imgur.com/jisHh.png" rel="noreferrer"><img src="https://i.stack.imgur.com/jisHh.png" alt="enter image description here"></a></p>
  
  <p>But doing the same on Safari/Firefox, on <code>/user</code> GET, that header is missing (?)</p>
  
  <p><a href="https://i.stack.imgur.com/64j7L.png" rel="noreferrer"><img src="https://i.stack.imgur.com/64j7L.png" alt="enter image description here"></a></p>
  
  <p><strong>Laravel 5.6 CORS setup</strong></p>
  
  <pre><code>'supportsCredentials' =&gt; false,
  'allowedOrigins' =&gt; [env('ALLOWED_ORIGINS')],
  'allowedOriginsPatterns' =&gt; [],
  'allowedHeaders' =&gt; ['Origin', 'Content-Type', 'X-Requested-With', 'Accept', 'Authorization'],
  'allowedMethods' =&gt; ['*'],
  'exposedHeaders' =&gt; ['*'],
  'maxAge' =&gt; 0,
  </code></pre>
  
  <p><strong>The tools</strong></p>
  
  <ol>
  <li>Laravel Mix </li>
  <li>Laravel 5.6+</li>
  <li>axios </li>
  <li>Vue.js 2</li>
  <li>@websanova/vue-auth</li>
  </ol>
  
  <p>I am also setting the below on axios as defaults. There is no reason that this very code that works on Chrome latest, doesn't work on FF/Safari latest. I have been banging my head against this for hours, to no avail.</p>
  
  <pre><code>window.axios = axios;
  window.axios.defaults.headers.post['Content-Type'] = 'application/json';
  window.axios.defaults.headers.common['X-Requested-With'] = 'XMLHttpRequest';
  window.axios.defaults.baseURL = baseURL;
  </code></pre>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I noticed that Authorization Bearer gets set for <code>/user</code> GET on Chrome, but not on Firefox or Safari. This is absurd. What could be going wrong here?</p>