Cors (cross Origin Resource Sharing) Using Php

i just followed PHP header of CORS and i have a strange behavior here i create a two simple pages one page (content.php) using port 1112 and the other page which (sample.html) usi

Solution 1:

Make the following changes to your code:

File: content.php

<?php//header("Access-Control-Allow-Origin: http://localhost:1113/sample.html");
header("Access-Control-Allow-Origin: http://localhost:1113");

?>

It should work.

The definition of same origin as enforced by SOP (and that CORS helps bypass) is: "Two pages have the same origin if the protocol, port, and host are the same for both pages.".

In your code, you are supposed to add the CORS header to reflect the origin that can be allowed by the browser to display the contents of "content.php" hence you have to specify the "origin" as the header value and that is http://localhost:1113 (not 'http://localhost:1113/sample.html').

Also, the statement "Unfortunately I believe you will get CORS issues no matter what with localhost, consider trying the local IP instead." in Fredo's answer is not correct. The browser will treat [scheme+host+port] in totality when determining the origin. So, using localhost with different port numbers should be treated as different origins without any issue.

Solution 2:

Try adding these headers:

"Access-Control-Allow-Headers: Cache-Control, Pragma, Origin, Authorization, Content-Type, X-Requested-With""Access-Control-Allow-Methods: GET, PUT, POST"

It might also help to add this as a server method rather than via the page in PHP, if apache either in your httpd.conf or in .htaccess.

This answer was derived from this blog post (using node.js / express) http://williambert.online/2013/06/allow-cors-with-localhost-in-chrome/

Solution 3:

You may add following lines in  .htaccess code where you have palce sample.html

Header add Access-Control-Allow-Origin "*"
Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

OR

 In sample.html file add below headers on top.

 header("Access-Control-Allow-Origin:*");