: Can apache both redirect and set CORS headers? I encountered the following browser console message, using apache to redirect from http to https XMLHttpRequest cannot load http://xxx. Redirect

@Smith883

Posted in: #Apache

I encountered the following browser console message, using apache to redirect from http to https


XMLHttpRequest cannot load xxx. Redirect from 'http://xxx' to 'https://xxx' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://current_page' is therefore not allowed access.


Even though xxx has correct CORS headers set.

Turns out that apache's "redirect all" directive:

<VirtualHost *:80>
ServerName servername
Redirect permanent / servername/ </VirtualHost>


apparently needs to include a CORS header or the redirect itself will be rejected by web browser.

Is it possible to have apache's "redirect permanent" also include CORS headers?

I tried this, from random googling:

<VirtualHost *:80>
ServerName xxx
# hope this preserves url's for the auto redir :)
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
Header always set Access-Control-Max-Age "1000"
Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"
Redirect permanent / xxx/ </VirtualHost>


Or any other work around here?

Vote Up Vote Down

Login to post a comment!