I seem to always post questions where no one can answer so here to hoping I get some help...

Ive been building 2 projects at the moment. A website using Laravel and an API using Laravel. All data is stored in the API and the website layer is merely a front-end for presenting the data it retrieves from the API. The website makes calls to the API VIA cURL and I pass the basic auth VIA the headers eg.:

$curlHandler = curl_init();

curl_setopt($curlHandler, CURLOPT_URL, $url);
curl_setopt($curlHandler, CURLOPT_USERPWD, 'username:password');
curl_setopt($curlHandler, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_setopt($curlHandler, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
curl_setopt($curlHandler, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curlHandler, CURLOPT_FRESH_CONNECT, TRUE);

$exec = curl_exec($curlHandler);
$response = json_decode($exec);
$info = (object) curl_getinfo($curlHandler);
curl_close($curlHandler);

The API outputs responses like so:

return Response::json(MyModel::find(1), 200);

Everything works 100% and ive actually even managed to get PUT, PATCH and DELETE requests to work aswell.

My problem comes in when I start to make calls against the API using jQuery as CORS kicks in. I was helped by someone who told me to use the below code to handle the basic auth headers through my AJAX request:

$.ajax({
	url: 'http://api',
	type: 'GET',
	dataType: 'json',
	beforeSend: function (xhr) {
		xhr.setRequestHeader(
				'Authorization',
				'Basic ' + btoa('username:password'));
	}
}).complete(function () {

}).fail(function () {

});

I then read I need to add allowed access to my JSON response like so:

return Response::json('response', 200, array('Access-Control-Allow-Origin' => 'http://domain'));

When I use a combination of basic auth and the CORS response I still get a CORS error. If I drop the auth then the CORS works. If I place my request on the same domain then the basic auth works... Its almost like the combination of both doesnt work.

Ultimately what im trying to achieve is that authentication is approved and I then specify the CORS allowed domain which is a value associated to the user in the DB...

I just read this post and it seems like there is a problem with Laravel regarding this?: http://laravel.io/forum/03-28-2014-how-to-handle-cors