Issues with Header set Access-Control-Allow-Origin

1
votes

I have the following in my .htaccess file:

Header set Access-Control-Allow-Origin: "*"

It works perfectly! But it is bad security practise.

When I change it to:

Header set Access-Control-Allow-Origin: "http://example.com"

I get the following error:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://example.com/oc/catalog/view/javascript/font-awesome/fonts/fontawesome-webfont.woff2?v=4.4.0. (Reason: CORS header 'Access-Control-Allow-Origin' does not match 'http://example.com').

How do I handle this?

1
apache.htaccess
The error message doesn't say that. If it did then you'd been generating a cross origin error for a request to the same origin. It looks like you've sanitised the URL by replacing every host name with example.com and, in the process, hidden the problem. - Quentin
I haven't made any changes to the url, except that I changed the website name to example. If you want me to list the unedited info, please let me know. Please note, I get this error when accessing the website through www.example.com instead of example.com - user3980196
Yes, list the unedited info. At the moment the question claims you are making a request from http://example.com/ to http://example.com/ and it is blocked because it isn't from http://example.com/. - Quentin
I am accessing the website www.arvindint.com/oc. In the htaccess, I have entered - Header set Access-Control-Allow-Origin: "http://arvindint.com". The error I get is - Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at arvindint.com/oc/catalog/view/javascript/font-awesome/fonts/‌​…. (Reason: CORS header 'Access-Control-Allow-Origin' does not match 'arvindint.com'). Stackoverflow seems to be removing the "http://" before the links in the comments. - user3980196
The actual error message you get (in Chrome) is: Font from origin 'http://arvindint.com' has been blocked from loading by Cross-Origin Resource Sharing policy: The 'Access-Control-Allow-Origin' header has a value 'http://arvindint.com' that is not equal to the supplied origin. Origin 'http://www.arvindint.com' is therefore not allowed access. As my answer says, http://arvindint.com is not the same as http://www.arvindint.com. One has an extra www. in it. - Quentin

1 Answers

0
votes

From the live site:

Font from origin 'http://arvindint.com' has been blocked from loading by Cross-Origin Resource Sharing policy: The 'Access-Control-Allow-Origin' header has a value 'http://arvindint.com' that is not equal to the supplied origin. Origin 'http://www.arvindint.com' is therefore not allowed access.

From a comment from the OP:

Please note, I get this error when accessing the website through www.example.com instead of example.com

That is your problem.

If you give permission to example.com but not to www.example.com then you can't access it from www.example.com.

Permissions are on a per-origin basis, not on a per-second-level-domain basis.

Pick one of the two host names (with or without www) and stick to it. Redirect from one to the other. Don't host your site on two different host names. Doing so is more trouble than it is worth.