Cors in routes that i apply jwt.auth middleware

When i try to make a http request in a middleware group with the jwt.auth i receive:

:9000/#/dash/tipodeprodutos:1 Access to XMLHttpRequest at 'https://api2.jcontrole.com.br/api/notificacoes/gerais' from origin 'http://localhost:9000' has been blocked by CORS policy: Request header field token is not allowed by Access-Control-Allow-Headers in preflight response.

I have this routes without the jwt middleware:

<?php

use Illuminate\Http\Request;

Auth::routes();

//Route::post('login', 'UserController@acessarSistema'); 
Route::post('login', 'UserController@authenticate');

This works normally but when i try to make a http request in a group with the jwt auth i receive cors errors:

$this->group(['middleware' => 'jwt.auth', ['prefix' => 'api']], function() {

      Route::post('admin/tipo-produto', 'TipoProdutosController@create')->name('cadastrar_tipo_produto')->middleware('checarPermissaoTela');

})

I try:

    protected $middlewareGroups = [
        'web' => [
            \App\Http\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\StartSession::class,
            // \Illuminate\Session\Middleware\AuthenticateSession::class,
            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
            \App\Http\Middleware\VerifyCsrfToken::class,
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],

        'api' => [
            'throttle:60,1',
            'bindings',
            **\Barryvdh\Cors\HandleCors::class,**
        ],
    ];

I add in Kernel.php the cors package:

    protected $middleware = [
        \Barryvdh\Cors\HandleCors::class,
        \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
        \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
        \App\Http\Middleware\TrimStrings::class,
        \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
        \App\Http\Middleware\TrustProxies::class,

    ];

In cofig/cors.php:

<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Laravel CORS
    |--------------------------------------------------------------------------
    |
    | allowedOrigins, allowedHeaders and allowedMethods can be set to array('*')
    | to accept any value.
    |
    */

    'supportsCredentials' => false,
    'allowedOrigins' => ['*'],
    'allowedOriginsPatterns' => [],
    'allowedHeaders' => ['*'],
    'allowedMethods' => ['*'],
    'exposedHeaders' => [],
    'maxAge' => 0,

];

Also tried put in the public/index.php:

header('Access-Control-Allow-Origin: *');  
header('Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS');

tymondesigns / jwt-auth

Cors in routes that i apply jwt.auth middleware #1785