Asked  2 Years ago    Answers:  5   Viewed   94 times

I am trying to post form data from to via CORS. My ajax code is this:

        $("#submit").live('click',function() {
            var url = "";
            var data = $('#form').serialize();
                url : url,
                type: "POST",
                data : $('#form').serialize(),
                return false;


and the file cors.php in is as follows:

 header('Access-Control-Allow-Origin: *');
 header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
 echo "hai";

But still Access-control-Allow-Origin error is thrown. The error thrown is this:

XMLHttpRequest cannot load Origin is not allowed by Access-Control-Allow-Origin. 

I came to know that, using CORS by just allowing the remote website via headers, we can use cross-domain request. But when I tried like this, error is thrown. Have I missed anything in here? Here is my request/response headers:

Response Headers
Connection  Keep-Alive
Content-Length  487
Content-Type    text/html; charset=iso-8859-1
Date    Fri, 23 Aug 2013 05:53:20 GMT
Keep-Alive  timeout=15, max=99
Server  Apache/2.2.15 (CentOS)
WWW-Authenticate    Basic realm="Site two Server - Restricted Area"
Request Headers
Accept  */*
Accept-Encoding gzip, deflate
Accept-Language en-US,en;q=0.5
Content-Length  43
Content-Type    application/x-www-form-urlencoded; charset=UTF-8
User-Agent  Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:23.0) Gecko/20100101 Firefox/23.0



Finally, I myself have solved the problem explained in the question. The code that I have implemented for accessing header is incorrect.

The below mentioned two line code, when given, didn't work:

header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, GET, OPTIONS');

But handling CORS requests properly is a tad more involved. Here is a function that will respond more fully. The updated code is this :

    // Allow from any origin
    if (isset($_SERVER['HTTP_ORIGIN'])) {
        header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
        header('Access-Control-Allow-Credentials: true');
        header('Access-Control-Max-Age: 86400');    // cache for 1 day

    // Access-Control headers are received during OPTIONS requests

            header("Access-Control-Allow-Methods: GET, POST, OPTIONS");         

            header("Access-Control-Allow-Headers:        {$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']}");


    echo "You have CORS!";

I have found from another post It worked....

Tuesday, December 27, 2022

Yvo Cilon made me think about the multiple values. And pointed me in the right direction.

I searched for headers and noticed that on the webserver there was a header already set and I added it in my code.

I removed the header set in the webserver to have control on how and when it is used.

Thanks for sharing your thoughts.

Tuesday, October 18, 2022

what finally worked for me is xhr.setRequestHeader('Content-Type', 'text/plain');

EDIT: The server needs to add Access-Control-Allow-Headers: Content-Type to avoid this problem.

I am coming back to my own question a decade later. I don’t know if this is a good thing or a terrible thing.

Tuesday, September 13, 2022

For those interested: I use easyXDM for cross domain messaging. That solved my problem.

Tuesday, August 23, 2022
  1. GET requests are not preflighted. See Here
  2. When responding to a credentialed request, server must specify a domain, and cannot use wild carding. (must not be Access-Control-Allow-Origin: *). See Here
Thursday, October 27, 2022
Only authorized users can answer the search term. Please sign in first, or register a free account.
Not the answer you're looking for? Browse other questions tagged :

Browse Other Code Languages