Apache : CORS header 'Access-Control-Allow-Origin' missing

Question

i am calling some svg image in my website from some other using jquery post i get below error in console

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://abc/svgpaths/sample.svg. (Reason: CORS header 'Access-Control-Allow-Origin' missing).

i have below paramter set in my .htaccess file

<IfModule mod_headers.c>
     Header add Access-Control-Allow-Origin "*"
</IfModule>

i also tested a2enmod headers in putty it showed me Module headers already enabled

But when i use Ip instead of domain name

for eg : https://1.2.3.5/svgpaths/sample.svg

i get below error in console net::ERR_INSECURE_RESPONSE

i could not figure out what to do to fix it please guide me with issue.

Js code to call svg from other server

Case 1 with ip (differnt ssl on main and subdomain)

fabric.loadSVGFromURL("https://1.2.3.4/svgpaths/sample.svg", function(objects, options){
            var object = new fabric.util.groupSVGElements(objects, options);
            object.set({
                fill: '#000000',
                selectable:false
            });

Error : ERR_INSECURE_RESPONSE

Case 2 When called with differnet subdomain :(subdomain resolves to same ip as above case 1 , i recently pointed subdomain so is there somesetting in confi file that i missed )

fabric.loadSVGFromURL("https://abd.maindomain.com/svgpaths/sample.svg", function(objects, options){
            var object = new fabric.util.groupSVGElements(objects, options);
            object.set({
                fill: '#000000',
                selectable:false
            });

Error :Apache : CORS header 'Access-Control-Allow-Origin' missing

if you are using chrome, then close chrome, it's background processes, and start again. Sometimes chrome show this error by caching the domain name instead of ip address. — Biswajit Panday
no it did not worked, issue was that i added domain name later before it was just ip — pcoder
why you are using post method when you are just calling images from another website/domain, shouldn't it be a get method? besides the domain you are calling from yours, should be core enabled for your domain. — Biswajit Panday

pcoder pcoder · Accepted Answer · 2016-08-21T21:32:59

Adding this code in /etc/apache2/sites-available/default-ssl.conf fixed it for me.

Header set Access-Control-Allow-Origin "https://example.com"

Apache : CORS header 'Access-Control-Allow-Origin' missing

2 Answers