CORS blocked on some directories, but not others

user_5156237 0
Viewed 351

A week ago, I encountered a CORS error:

Access to XMLHttpRequest at [domainA/example/directory/file.xml] from origin [domainB] has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I solved this by editing .htaccess, adding:

<IfModule mod_headers.c>
    <FilesMatch ".+">
        Header set Access-Control-Allow-Origin "*"
    </FilesMatch>
</IfModule>

This worked! However, I am now encountering the same problem when requesting data at the same domain, at a different path (i.e. "domainA/different/example/directory/file.json").

Shouldn't I be able to request any file, in any directory, based on the edits I made to .htaccess? (located at "/.../.../www/[domainA-root]/.htaccess")

It's worth noting that in my first example, [domainA/example/directory/file.xml] is a XML view created by Drupal, and is not a static file in an actual directory.

drupal cors xmlhttprequest ajax
2 Answers

That looks like the typical case in which your browser is caching the response of a previous OPTIONS request to specific URLs requested previously, the header was not there before and the browser won't bother to check again until the TTL expires.

I would say: check it the headers are there doing a verbose curl request from your command line, I.e.

curl -v https://yourhost/yourURL

Then you can take it from there

user_23574110

rather than trying .+ in filematch, you should try:

<FilesMatch "\.(htm|html|css|js|php|json)$">
AddDefaultCharset UTF-8
DefaultLanguage en-US
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Methods "*"
</FilesMatch>
user_74425910
Related