[Apache]Access-Control-Allow-Origin

[holthelper]

im trying a json request through jquery and im getting an error saying im not allowed

ive seen using some hacks like:

<?php header('Access-Control-Allow-Origin: *'); ?>

and adding this in httpd-vhosts.conf:

Access-Control-Allow-Origin: <origin> | *

both have not worked and kinda stuck as to how to find a work around. even tried

--disable-web-security[COLOR=#000000]
[/COLOR]

 

[Dave]

And what is the exact error?

 

[holthelper]

[COLOR=#FF0000]Origin [/COLOR][URL="http://localhost/"]http://localhost[/URL][COLOR=#FF0000] is not allowed by Access-Control-Allow-Origin.
[/COLOR]

it has to do with CORS but i cant seem to find a answer that works

 

[Mootie]

enable cross-origin resource sharing

Go to apache section. Seems simple enough, although is a minor security risk. Ideally, do something like...

$allowed_origins = array('http://localhost', 'https://localhost');
if(isset($_SERVER['HTTP_ORIGIN']) && in_array($_SERVER['HTTP_ORIGIN'], $allowed_origins))
{
    header("Access-Control-Allow-Origin: ". $_SERVER['HTTP_ORIGIN']);
}

I think Google Chrome is the only browser that checks the origin.

 

[holthelper]

@mootie
im looking at the headers after sending that and i dont see it in there

ive found that doing a mod_rewrite with .htaccess is another form of bypass

Header add Access-Control-Allow-Origin *

with that i see it in the headers but i still get the error

 

[Mootie]

@mootie
im looking at the headers after sending that and i dont see it in there

ive found that doing a mod_rewrite with .htaccess is another form of bypass

Header add Access-Control-Allow-Origin *

with that i see it in the headers but i still get the error

Isn't it:

Header set Access-Control-Allow-Origin *

Also, make sure your browser isn't caching the response.

 

[s-p-n]

The Mozilla Developer documentation specifies all you need to know about modern Access-Control standards.
https://developer.mozilla.org/en-US/docs/HTTP_access_control

I highly advise against using the wildcard '*' in this header unless you specifically want to allow every service on the internet to access your web application. It's legal to provide a single service or a comma separated list of services (example: Access-Control-Allow-Origin: google.com, ragezone.com).

Another matter is the Access-Control-Allow-Credentials (boolean) header and it's relation with preflighted requests. If you are using the GET method and providing credentials (such as cookies- including but not limited to PHP sessions) without specifying appropriate Access Control headers within the request, then the server response is ignored by the modern browser.

Since you are trying to send data, you likely need to explicitly specify how you are sending data (access-control-allow-method), where the data is from (access-control-allow-origin), and if you want to use custom headers you need to specify them (access-control-allow-headers: X-HELLOWORLD)- and lastly but not least- if you want to send cookie data you need to allow credentials (access-control-allow-credentials: true). In addition to the server headers, the client (XMLHttpRequest, in your case) must specify a header that complements the server response.

Mozilla provides working examples here:
Examples of CORS in Action

Unfortunately the access-control standards are recognized more commonly as road-blocks than what they really are- an opportunity for a little certainty in a very chaotic environment.