CORS: PHP: Response to preflight request doesn’t pass. Am allowing origin

by

OK I had a similar issues recently and I solved everything only on the backend side with no .htaccess stuff.

when the browser sends cross server requests it firsts sends an OPTIONS request to make sure it is valid and it can send the “real” request.
After it gets a proper and valid response from OPTIONS, only then it sends the “real” request.

Now for both request on the backend you need to make sure to return the proper headers: content-type, allow-origin, allow-headers etc…

Make sure that in the OPTIONS request on the backend, the app returns the headers and returns the response, not continuing the full flow of the app.

In the “real” request, you should return the proper headers and your regular response body.

example:

    //The Response object
    $res = $app->response;

    $res->headers->set('Content-Type', 'application/json');
    $res->headers->set('Access-Control-Allow-Origin', 'http://example.com');
    $res->headers->set('Access-Control-Allow-Credentials', 'true');
    $res->headers->set('Access-Control-Max-Age', '60');
    $res->headers->set('Access-Control-Allow-Headers', 'AccountKey,x-requested-with, Content-Type, origin, authorization, accept, client-security-token, host, date, cookie, cookie2');
    $res->headers->set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');

    if ( ! $req->isOptions()) {
        // this continues the normal flow of the app, and will return the proper body
        $this->next->call();
    } else {
        //stops the app, and sends the response
        return $res;
    }

Things to remember:

  • if you are using: “Access-Control-Allow-Credentials” = true
    make sure that “Access-Control-Allow-Origin” is not “*”, it must be set with a proper domain!
    ( a lot of blood was spilled here :/ )

  • define the allowed headers you will get in “Access-Control-Allow-Headers”
    if you wont define them, the request will fail

  • if you using “Authorization: Bearer”, then “Access-Control-Allow-Headers” should also contain “Authorization”, if not, the request will fail

More Related Contents:

  1. Cross-Origin Request Headers(CORS) with PHP headers
  2. Laravel 5.1 API Enable Cors
  3. CORS not working php
  4. enable cors in .htaccess
  5. Laravel 5.2 CORS, GET not working with preflight OPTIONS
  6. HTTP OPTIONS request on Azure Websites fails due to CORS
  7. How can I echo HTML in PHP?
  8. When should I use prepared statements?
  9. POST an array from an HTML form without javascript [duplicate]
  10. What’s the best way to get the last element of an array without deleting it?
  11. PHP Parallel curl requests
  12. PHPMailer GoDaddy Server SMTP Connection Refused
  13. Search for a key in an array, recursively
  14. What is the syntax for accessing PHP object properties? [closed]
  15. How do you create optional arguments in php?
  16. Looping Through All a Server’s Sessions in PHP
  17. Creating a config file in PHP
  18. Understanding nested PHP ternary operator [duplicate]
  19. How to store the data in unicode in hindi language
  20. PDO + MySQL and broken UTF-8 encoding
  21. Posting JSON To Laravel
  22. Group subarrays by one column, make comma-separated values from other column within groups
  23. permission denied – php unlink
  24. Symfony 2.0 getting service inside entity
  25. Cross Domain Ajax Request with JQuery/PHP
  26. php date format YYYY-MM-DD minus or add one week from now?
  27. When do I use PHP_EOL instead of \n and vice-versa ? Ajax/Jquery client problem
  28. How to eliminate php5 Strict standards errors?
  29. Parsing multipart form data
  30. Debug a DOMDocument Object in PHP

Leave a Comment