call( 'OPTIONS', '/api/media', [], [], [], ['HTTP_Authorization' => 'Bearer ' . $this->getToken()] ); $response->assertHeader('Access-Control-Allow-Origin', '*'); } /** @test */ public function checkForNoCorsHeaderOnNonMediaEndpointLinks(): void { $response = $this->get('/blog'); $response->assertHeaderMissing('Access-Control-Allow-Origin'); } }