# Turn on CORS credentials for a separate Vue app

> A separate Vue origin needs supports_credentials and an explicit origin. A same-origin Inertia app needs neither.

- URL: https://laravel-vuejs.space/cors-supports-credentials-vue
- Author: Anass Ez-zouaine (https://laravel-vuejs.space/author/anass-ez-zouaine)
- Published: 2026-10-11
- Topics: Laravel, VueJs

People searching “Laravel CORS supports\_credentials” flip the flag, leave the origin as `*`, and the browser still drops the cookie. Credentials and a wildcard origin are not allowed together. The [CORS guide](https://laravel-vuejs.space/laravel-vue-cors) is the full config. This page is that one pair of keys.

> **TL;DR**
>
> -   A separate Vue origin needs supports\_credentials and an explicit origin.
> -   A same-origin Inertia app needs neither.
> -   Do not set `allowed_origins` to `['*']` in the same file as `supports_credentials => true`.
> -   Do not “fix” a 419 by editing this file.
>
> **Who it's for:** Laravel + Vue developers
>
> **Applies to:** Laravel 13 · Vue 3

## The fix

Same-origin Inertia does not use this file. If the Vue pages are served by Laravel, stop here.

For a SPA on another origin:

```php
'allowed_origins' => ['http://localhost:5173'],
'supports_credentials' => true,
```

The origin includes the scheme and the port. `http://localhost:5173` and `http://127.0.0.1:5173` do not match. The Vue client also has to send credentials. The Sanctum guide shows `withCredentials` and `withXSRFToken`.

## What to avoid

> **Gotcha**
>
> Do not set `allowed_origins` to `['*']` in the same file as `supports_credentials => true`. Do not “fix” a 419 by editing this file. A 419 means Laravel answered and the CSRF cookie was missing. That diagnosis is in the [CORS guide](https://laravel-vuejs.space/laravel-vue-cors).

## FAQ

**Q: How do I turn on CORS credentials for a separate Vue app?**

A separate Vue origin needs supports\_credentials and an explicit origin. A same-origin Inertia app needs neither.

**Q: What goes wrong with Laravel CORS supports_credentials?**

Many developers flip the flag, leave the origin as `*`, and the browser still drops the cookie. Do not set `allowed_origins` to `['*']` in the same file as `supports_credentials => true`.