awkawbandClaude Sonnet 5
a71ccc87bb
Laravel's own CORS middleware already sends a complete, correct set of Access-Control-* headers on every response. The nginx and caddy vhost configs were additionally setting a second, static set of the same headers, producing duplicates with conflicting values (e.g. two Access-Control-Allow-Methods headers, one "*" and one the app's real list). Browsers reject responses with duplicate/conflicting CORS headers - curl-based checks never noticed since only browsers enforce CORS header validation, but it broke real browser usage (login/API calls failing silently). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>