CORS issue in codeigniter 4: Response to preflight request doesn't pass access control check

Question

I'm making an api with Codeigniter 4 for a react application. Everything works fine in postman but when I make requests with axios (also tried fetch), it gets CORS error

Access to XMLHttpRequest at 'http://localhost:8080/testpost' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I tried adding headers to base controller:

header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Methods: POST,GET, OPTIONS");
header("Access-Control-Allow-Headers: *");

Now it works fine with requests without JSON body, but when I send json body same error occurs.

axios.post("http://localhost:8080/testpost", { data: "test" })
    .then((response) => {
        console.log(response);
    })
    .catch((err) => {
        console.log("error!!!");
    });

// Routes.php
$routes->post('/testpost', 'Home::testPost');

// Home Controller
public function testPost()
{
    return $this->response->setJSON('test response');
}

Thanks for your help

score 10 · Accepted Answer · edited Feb 24 '21 at 08:20

10

Please try by setting Apache response headers and redirect method to .htaccess in root of www/public directory, like this:

#Redirect for CORS Preflight request
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=200,L]
#Set headers to access CORS Requests / allowing localhost only
Header always add Access-Control-Allow-Origin "*"
Header always add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header always add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

NOTE: Be careful by adding Header always add Access-Control-Allow-Origin "*" to your .htaccess, "*" open doors for attackers, replace * with your domain or subdumain!

edited Feb 24 '21 at 08:20

Mamrezo

1,309
16
20

answered May 21 '20 at 06:43

Akash prajapati

384
3
7

Is there any problem with this solution? – Akash prajapati May 21 '20 at 06:46
Thanks for your response, unfortunately it's not working. It is doing the same thing as setting headers in PHP. – eminsh May 21 '20 at 15:09
If it's done then can you please mark this as "Done"? – Akash prajapati May 21 '20 at 18:28
Thanks, now it works. I hoped a PHP way for this. but for now I think this is the best way. – eminsh May 21 '20 at 18:38
How *exactly* do you set Apache response headers? `httpd.conf`? – ron_g Sep 21 '20 at 19:35
1

@ron_g , you must add these lines to `.htaccess` file in your root public path. and be careful to not duplicate first 3 lines. – Mamrezo Feb 23 '21 at 09:35
Added this in the mode_rewrite.c, it worked. I used only `Header always add Access-Control-Allow-Headers "content-type"` because I'm not sending any headers. No other changes in the front end. – Linga Jun 03 '21 at 15:12

score 0 · Answer 2 · answered Jan 02 '22 at 21:45

If the problem is because fonts are blocked due to www.yourdomain.com, then put these lines in your .htaccess file

# Rewrite "www.example.com -> example.com"
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L]

Default folder of CodeIgniter already contain complete .htaccess file.

score 0 · Answer 3 · answered Feb 05 '23 at 10:42

Add the given code to your construct method.

header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: X-API-KEY, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method");
header("Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE");
$method = $_SERVER['REQUEST_METHOD'];
if($method == "OPTIONS") {
  die();
}

score 0 · Answer 4 · answered Feb 18 '23 at 12:34

On your index.php on public directory, just paste the following codes to set

headers for the response
header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Headers: X-API-KEY, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method");
header("Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE");
$method = $_SERVER['REQUEST_METHOD'];
if($method == "OPTIONS") {
die();
}

just before the response area

CORS issue in codeigniter 4: Response to preflight request doesn't pass access control check

4 Answers4

Linked