# CORS on Slim v4 at slim4-skeleton

**URL:** <https://discourse.slimframework.com/t/cors-on-slim-v4-at-slim4-skeleton/4000>\
**Category:** Questions\
**Created:** [April 3, 2020, 8:42am UTC](https://discourse.slimframework.com/t/cors-on-slim-v4-at-slim4-skeleton/4000 "2020-04-03T08:42:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![huthief](https://avatars.discourse-cdn.com/v4/letter/h/da6949/32.png) [@huthief](https://discourse.slimframework.com/u/huthief)\
**Post date:** [April 3, 2020, 8:42am UTC](https://discourse.slimframework.com/t/cors-on-slim-v4-at-slim4-skeleton/4000/1 "2020-04-03T08:42:29Z")

</div>

Thanks to for [GitHub - odan/slim4-skeleton: A Slim 4 Skeleton](https://github.com/odan/slim4-skeleton). It’s useful for startup.

I found Middleware/CorsMiddleware.php, but I don’t know how to use it .

I add ’ $app-\>add(CorsMiddleware::class);’ to config/middleware.php , but it’s not work for me.

Is any idea for it?

Thank you.

config/middleware.php

> return function (App $app) {  
> // Parse json, form data and xml  
> $app-\>addBodyParsingMiddleware();
> 
> ```
> $app->add(ValidationExceptionMiddleware::class);
> $app->add(TwigMiddleware::class);
> $app->add(TranslatorMiddleware::class);
> $app->add(SessionMiddleware::class);
> $app->add(CorsMiddleware::class);
> $app->addRoutingMiddleware();
> $app->add(BasePathMiddleware::class);
> $app->add(ErrorMiddleware::class);
> };
> 
> ```

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [April 3, 2020, 11:40am UTC](https://discourse.slimframework.com/t/cors-on-slim-v4-at-slim4-skeleton/4000/2 "2020-04-03T11:40:11Z")

</div>

Hi @huthief

Can you please show us the browser error message  
and the request + response headers?

Read more: [https://odan.github.io/2019/11/24/slim4-cors.html](https://odan.github.io/2019/11/24/slim4-cors.html)

---

<div class="post-metadata">

**Author:** ![huthief](https://avatars.discourse-cdn.com/v4/letter/h/da6949/32.png) [@huthief](https://discourse.slimframework.com/u/huthief)\
**Post date:** [April 8, 2020, 3:52am UTC](https://discourse.slimframework.com/t/cors-on-slim-v4-at-slim4-skeleton/4000/3 "2020-04-08T03:52:29Z")

</div>

Hi, @odan

There are the infomation .  
The frontend is angular. Maybe is angular issue?

> Access to XMLHttpRequest at ‘[https://www.fycd.info/api/auth/v1/login](https://www.fycd.info/api/auth/v1/login)’ from origin ‘[https://cds04.fycd.info](https://cds04.fycd.info)’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

 ![header](https://canada1.discourse-cdn.com/flex030/uploads/slimframework/original/2X/d/d79db06a92fd3b9464a998f3cc35531fc57b62da.jpeg) ![response](https://canada1.discourse-cdn.com/flex030/uploads/slimframework/original/2X/a/ae28e1974f581fff39535f05c588203f7d080443.jpeg)

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [April 8, 2020, 7:29am UTC](https://discourse.slimframework.com/t/cors-on-slim-v4-at-slim4-skeleton/4000/4 "2020-04-08T07:29:26Z")

</div>

1. The `Access-Control-Request-Headers` header is missing in the request. This could be an Angular XHR config issue.

2. Add the routes for the http OPTIONS method to handle the preflight request. See my link from above.

---

<div class="post-metadata">

**Author:** ![huthief](https://avatars.discourse-cdn.com/v4/letter/h/da6949/32.png) [@huthief](https://discourse.slimframework.com/u/huthief)\
**Post date:** [April 12, 2020, 8:41am UTC](https://discourse.slimframework.com/t/cors-on-slim-v4-at-slim4-skeleton/4000/5 "2020-04-12T08:41:27Z")

</div>

@odan Thank you. It works.

I missed the routes for the http OPTIONS method to handle the preflight request XD