Header set Access-Control-Allow-Origin in .htaccess doesn't work

.htaccess mod-rewrite rewrite cors
user1401592 picture user1401592 · May 17, 2012 · Viewed 244.9k times · Source

I can't figure out why my .htaccess header settings doesn't work.

My .htaccess file content:

Header set Access-Control-Allow-Origin *
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
Header always set Access-Control-Allow-Headers "*"
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php [QSA,L]

But when I remove Header's and add them in index.php then everything works fine. 

header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: PUT, GET, POST, DELETE, OPTIONS");
header("Access-Control-Allow-Headers: *");

What am i missing?

Answer

imbrizi picture imbrizi · Jul 27, 2012

This should work:

Header add Access-Control-Allow-Origin "*"
Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

Related questions

"OR" Flag in .htaccess mod_rewrite

Just found this .htaccess rewrite code RewriteEngine on RewriteCond %{HTTP_HOST} ^my.domain.com$ [NC,OR] RewriteCond %{REQUEST_URI} !public/ RewriteRule (.*) /public/$1 [L] And I was wondering what was the purpose of the "OR" flag. Already checked the doc http://…

Read More
Preserve HTTP/HTTPS protocol in .htaccess redirects

I have to redirect port 80 to 2368 in htaccess but I'd like to keep the requested protocol intact so that SSL doesn't break. I currently have this: RewriteCond %{HTTP_HOST} ^sub.domain.com$ [NC] RewriteRule ^ http://sub.domain.com:2368%{REQUEST_URI} […

Read More
mod_rewrite: remove trailing slash (only one!)

I use mod_rewrite/.htaccess for pretty URLs. I'm using this condition/rule to eliminate trailing slashes (or rather: rewrite to the non-trailing-slash-URL, by a 301 redirect; I'm doing this to avoid duplicate content and because I like URLs with no …

Read More