CORS with php headers

Question

I have a simple PHP script that I am trying to execute a CORS request between domains:

<?php header("Access-Control-Allow-Origin: *"); header("Access-Control-Allow-Headers: *"); ... 

But I still get the error:

X-Requested-With request header field not allowed Access-Control-Allow-Headers

Anything I miss?

Answer 1

Access-Control-Allow-Headers does not allow * as a valid value, see the Mozilla documentation here .

Instead of an asterisk, you should send the accepted headers (first X-Requested-With as stated in the error message).

Answer 2

Properly handling CORS requests is more attractive. Here is a function that will respond more fully (and correctly).

 /** * An example CORS-compliant method. It will allow any GET, POST, or OPTIONS requests from any * origin. * * In a production environment, you probably want to be more restrictive, but this gives you * the general idea of what is involved. For the nitty-gritty low-down, read: * * - https://developer.mozilla.org/en/HTTP_access_control * - http://www.w3.org/TR/cors/ * */ function cors() { // Allow from any origin if (isset($_SERVER['HTTP_ORIGIN'])) { // Decide if the origin in $_SERVER['HTTP_ORIGIN'] is one // you want to allow, and if so: header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}"); header('Access-Control-Allow-Credentials: true'); header('Access-Control-Max-Age: 86400'); // cache for 1 day } // Access-Control headers are received during OPTIONS requests if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') { if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) // may also be using PUT, PATCH, HEAD etc header("Access-Control-Allow-Methods: GET, POST, OPTIONS"); if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'])) header("Access-Control-Allow-Headers: {$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']}"); exit(0); } echo "You have CORS!"; } 

Answer 3

I got the same error and fixed it with the following PHP in my internal script:

 header('Access-Control-Allow-Origin: *'); header('Access-Control-Allow-Methods: GET, POST'); header("Access-Control-Allow-Headers: X-Requested-With"); 

Answer 4

Many descriptions on the Internet do not mention that specifying Access-Control-Allow-Origin not enough. Here is a complete example that works for me:

 <?php if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { header('Access-Control-Allow-Origin: *'); header('Access-Control-Allow-Methods: POST, GET, DELETE, PUT, PATCH, OPTIONS'); header('Access-Control-Allow-Headers: token, Content-Type'); header('Access-Control-Max-Age: 1728000'); header('Content-Length: 0'); header('Content-Type: text/plain'); die(); } header('Access-Control-Allow-Origin: *'); header('Content-Type: application/json'); $ret = [ 'result' => 'OK', ]; print json_encode($ret); 

Answer 5

I just managed to get dropzone and another plugin to work with this fix (angularjs + php backend)

  header('Access-Control-Allow-Origin: *'); header("Access-Control-Allow-Credentials: true"); header('Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS'); header('Access-Control-Max-Age: 1000'); header('Access-Control-Allow-Headers: Origin, Content-Type, X-Auth-Token , Authorization'); 

add this to your upload.php file or where you send your request (for example, if you have upload.html and you need to attach files to upload.php, copy and paste these 4 lines). Also, if you use CORS plugins / addons in chrome / mozilla, be sure to enable them more than once to enable CORS.

Answer 6

If you want to create a CORS service from PHP, you can use this code as the first step in your file that processes requests:

 // Allow from any origin if(isset($_SERVER["HTTP_ORIGIN"])) { // You can decide if the origin in $_SERVER['HTTP_ORIGIN'] is something you want to allow, or as we do here, just allow all header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}"); } else { //No HTTP_ORIGIN set, so we allow any. You can disallow if needed here header("Access-Control-Allow-Origin: *"); } header("Access-Control-Allow-Credentials: true"); header("Access-Control-Max-Age: 600"); // cache for 10 minutes if($_SERVER["REQUEST_METHOD"] == "OPTIONS") { if (isset($_SERVER["HTTP_ACCESS_CONTROL_REQUEST_METHOD"])) header("Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE, PUT"); //Make sure you remove those you do not want to support if (isset($_SERVER["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"])) header("Access-Control-Allow-Headers: {$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']}"); //Just exit with 200 OK with the above headers for OPTIONS method exit(0); } //From here, handle the request as it is ok 

Answer 7

CORS can be a headache if we do not correctly understand its functioning. I use them in PHP and they work without problems. link here

 header("Access-Control-Allow-Origin: *"); header("Access-Control-Allow-Credentials: true"); header("Access-Control-Max-Age: 1000"); header("Access-Control-Allow-Headers: X-Requested-With, Content-Type, Origin, Cache-Control, Pragma, Authorization, Accept, Accept-Encoding"); header("Access-Control-Allow-Methods: PUT, POST, GET, OPTIONS, DELETE"); 

Answer 8

This code works for me when using angular 4 as client and PHP as server.

("Access-Control-Allow-Origin: *");

Answer 9

it should work

 header("Access-Control-Allow-Origin: *"); header("Access-Control-Allow-Headers: X-Requested-With, Content-Type, Origin, Cache-Control, Pragma, Authorization, Accept, Accept-Encoding"); 

Answer 10

This code example in the above code seems to be a bug. In this code, response headers are contained in {curly brackets}. As soon as I deleted them, Axios finally stopped throwing errors.

Answer 11

add this code to .htaccess

add a custom authentication key to the header, such as app_key, auth_key..etc

 Header set Access-Control-Allow-Origin "*" Header set Access-Control-Allow-Headers: "customKey1,customKey2, headers, Origin, X-Requested-With, Content-Type, Accept, Authorization" 

Answer 12

Good. Ainen Dedigin Gibi Oldu. Bende yle yaptim