I currently have an app locally on http://transmitting-app-local/, and it has a JavaScript file that POST data to another app on http://receiving-app-local/ using the fetch API.

I disabled the CSRF protection for the receiving app in the bootstrap/app.php:

    ->withMiddleware(function (Middleware $middleware) {
        $middleware->validateCsrfTokens(except: [
            'http://transmitting-app-local/*'
        ]);
    })

But I still got Error 419 and the following CORS error in the browser:

Access to fetch at ‘http://receiving-app-local/receive’ from origin ‘http://transmitting-app-local/’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. If an opaque response serves your needs, set the request’s mode to ‘no-cors’ to fetch the resource with CORS disabled

Is this something I need to add to the POST request on the JavaScript side? Or also configure something on the receiving app CORS settings? If so, how can I do it?

I did publish the cors.php config file using php artisan config:publish cors on the receiving app, and I seem to have allowed CORS from everywhere and it still doesn’t work:

// cors.php
    'paths' => ['*'],

    'allowed_methods' => ['*'],

    'allowed_origins' => ['*'],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => false,

And now there’s no error in the browser but still the response is Error 419

Do I also need to configure the cors.php on the trasmitting app?