Turn on CORS credentials for a separate Vue app

A separate Vue origin needs supports_credentials and an explicit origin. A same-origin Inertia app needs neither.

1 min read

For your AI agent

Copies a prompt. Paste it into the AI agent you already have open.

Read https://laravel-vuejs.space/cors-supports-credentials-vue.md
A separate Vue origin needs supports_credentials and an explicit origin. A same-origin Inertia app needs neither.
Do not set allowedorigins to [''] in the same file as supportscredentials => true.
Do not "fix" a 419 by editing this file.
Show the diff. Do not commit.
On this page · 3 sections
  1. The fix
  2. What to avoid
  3. FAQ

People searching “Laravel CORS supports_credentials” flip the flag, leave the origin as *, and the browser still drops the cookie. Credentials and a wildcard origin are not allowed together. The CORS guide is the full config. This page is that one pair of keys.

TL;DR

  • A separate Vue origin needs supports_credentials and an explicit origin.
  • A same-origin Inertia app needs neither.
  • Do not set allowed_origins to ['*'] in the same file as supports_credentials => true.
  • Do not “fix” a 419 by editing this file.

Who it's for: Laravel + Vue developers

Applies to: Laravel 13 · Vue 3

The fix#

Same-origin Inertia does not use this file. If the Vue pages are served by Laravel, stop here.

For a SPA on another origin:

php
'allowed_origins' => ['http://localhost:5173'],
'supports_credentials' => true,

The origin includes the scheme and the port. http://localhost:5173 and http://127.0.0.1:5173 do not match. The Vue client also has to send credentials. The Sanctum guide shows withCredentials and withXSRFToken.

What to avoid#

Gotcha

Do not set allowed_origins to ['*'] in the same file as supports_credentials => true. Do not “fix” a 419 by editing this file. A 419 means Laravel answered and the CSRF cookie was missing. That diagnosis is in the CORS guide.

FAQ#

How do I turn on CORS credentials for a separate Vue app?

A separate Vue origin needs supports_credentials and an explicit origin. A same-origin Inertia app needs neither.

What goes wrong with Laravel CORS supports_credentials?

Many developers flip the flag, leave the origin as *, and the browser still drops the cookie. Do not set allowed_origins to ['*'] in the same file as supports_credentials => true.

Found this useful?

Ask questions, share what you built.

Join thousands of Laravel and Vue developers in our Facebook group, or get new posts in your Telegram feed. Sharing this article helps too.

Join the Facebook group Follow on Telegram

Keep reading

Newsletter

Get the best of Laravel & Vue, once a month.

One short email with new guides, release notes worth reading and hand-picked community links. No spam, unsubscribe any time.

RSS feed Telegram channel