fix cors v2

app/Http/Middleware/CollectCors.php

@@ -25,15 +25,27 @@ class CollectCors
 
     private function corsHeaders(Request $request): array
     {
-        // Get the origin from the request, default to '*' if not present
+        // Get the origin from the request
-        $origin = $request->header('Origin', '*');
+        $origin = $request->header('Origin');
 
+        // If origin is present, allow it with credentials
+        // Otherwise, use wildcard without credentials
+        if ($origin) {
             return [
                 'Access-Control-Allow-Origin' => $origin,
                 'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS',
                 'Access-Control-Allow-Headers' => 'Content-Type, X-Requested-With',
                 'Access-Control-Max-Age' => '86400',
                 'Access-Control-Allow-Credentials' => 'true',
+                'Vary' => 'Origin',
+            ];
+        }
+
+        return [
+            'Access-Control-Allow-Origin' => '*',
+            'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS',
+            'Access-Control-Allow-Headers' => 'Content-Type, X-Requested-With',
+            'Access-Control-Max-Age' => '86400',
         ];
     }
 }