maybe this will fix the CORS

config/app.php

@@ -65,6 +65,7 @@ return [
         App\Providers\EventServiceProvider::class,
         App\Providers\RouteServiceProvider::class,
         App\Utilities\Zarinpal\Laravel\ZarinpalServiceProvider::class,
+        Fruitcake\Cors\CorsServiceProvider::class
     ],
 
     'aliases' => [