1

I have some CORS and preflight problems with my software I can't solve. To test it I was ursing a cors test site to simulate it. When I make an api request to my server application I get the following error:

Access to XMLHttpRequest at 'https://example.org/api/articles/2387' from origin 'https://www.test-cors.org' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.

I was adding the follwing code at the end of my .htaccess file, but I still get the same error:

<IfModule mod_headers.c>
Header append X-Frame-Options SAMEORIGIN
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
Header always set Access-Control-Allow-Headers "*, Authorization, authorization"
</IfModule>
<IfModule mod_rewrite.c>
RewriteEngine on
# always return 200 for preflight OPTIONS requests
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=200,L]

Also the server is returning "Status Code: 401 Unauthorized". As Request Headers I was adding an authorization header (example string):

Authorization: Basic DJFNCNDJKS7574hdfnDDBHr4593834nfnd=

But it's the right authorization, because I tested the exact same header locally with curl several times (without cross origin) and I always get the requested data. Any idea what's going on here and how I can solve it?

Edit: I got it to work. I placed the additional htaccess content at the end of the file first. Since I added it at the beginning of the file its working.

TmCrafz
  • 139
  • 1
  • 9
  • 1
    The CORS policy on https://www.test-cors.org would need to be set to allow the API hosted at https://example.org to make cross origin requests. In other words, the CORS policy needs to be set on https://www.test-cors.org, because that is where the cross origin request is being made to. Do you have access to only the API server? – DubStep Jan 25 '21 at 19:59
  • 1
    "401 Unauthorized" - but doesn't the browser automatically send the OPTIONS request prior to your request - without an `Authorization` header? – MrWhite Jan 26 '21 at 01:04

0 Answers0