Answers for "cors javascript"

php access origin

<?php
 header("Access-Control-Allow-Origin: *");

javascript cors error

$.ajax({
            headers: { "Accept": "application/json"},
            type: 'GET',
            url: 'http://cl.ly/2wr4',
            crossDomain: true,
            beforeSend: function(xhr){
                xhr.withCredentials = true;
          },
            success: function(data, textStatus, request){
                console.log(data);
            }
 });

cross origin even with allow header

header('Access-Control-Allow-Origin: http://localhost:8100');
header ("Access-Control-Expose-Headers: Content-Length, X-JSON");
header ("Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS");
header ("Access-Control-Allow-Headers: Content-Type, Authorization, Accept, Accept-Language, X-Authorization");
header('Access-Control-Max-Age: 86400');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    // The request is using the POST method
    header("HTTP/1.1 200 OK");
    return;

}

what is CORS

Use CORS to allow cross-origin access. 
CORS is a part of HTTP that lets servers specify any other hosts 
from which a browser should permit loading of content.

How to block cross-origin access
To prevent cross-origin writes, 
	check an unguessable token in the request — known as a Cross-Site Request Forgery (CSRF) token. 
    prevent cross-origin reads of pages that require this token.
To prevent cross-origin reads of a resource, 
	ensure that it is not embeddable.
    prevent embedding because embedding a resource always leaks some information about it.
To prevent cross-origin embeds, 
	ensure that your resource cannot be interpreted
    Browsers may not respect the Content-Type header. 
For example, if you point a <script> tag at an HTML document, the browser will try to parse the HTML as JavaScript. When your resource is not an entry point to your site, you can also use a CSRF token to prevent embedding.

cors in javascript

Cross-Origin Resource Sharing (CORS) is an HTTP-header based mechanism that 
allows a server to indicate any other origins (domain, scheme, or port) than 
its own from which a browser should permit loading of resources. CORS also 
relies on a mechanism by which browsers make a “preflight” request to the 
server hosting the cross-origin resource, in order to check that the server 
will permit the actual request. In that preflight, the browser sends headers 
that indicate the HTTP method and headers that will be used in the actual 
request.