CODEWITHSUNDEEP
javascriptajax.htaccesscors
thugsb
thugsb

Reputation: 23426

Why is this simple CORS GET failing?

I have a server running apache. The .htaccess contains the following:

<IfModule mod_headers.c>
  <FilesMatch "\.(eot|ttf|otf|woff|css)$">
    Header add Access-Control-Allow-Origin "*"
  </FilesMatch>
</IfModule>

Why is it that

$.get('https://www.sarahlawrence.edu/_assets/v6/fonts/otama-text-regular/otamatextregular.eot')`

works (try it in the console from any domain), whereas 

$.get('https://www.sarahlawrence.edu/_assets/v6/lib/icons.data.svg.css')

fails with this error:

XMLHttpRequest cannot load https://www.sarahlawrence.edu/_assets/v6/lib/icons.data.svg.css. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://whatever.com' is therefore not allowed access.

And how can I get it working?

Upvotes: 1

Views: 168

Answers (2)

Peter Scott
Peter Scott

Reputation: 1316

The missing Header can be confirmed using curl:

 curl -v https://www.sarahlawrence.edu/_assets/v6/fonts/otama-text-regular/otamatextregular.eot > delme.txt

 curl -v https://www.sarahlawrence.edu/_assets/v6/lib/icons.data.svg.css > delme.txt

The regex should be happy with the filename so I expect that the problem is either because there is a conflicting configuration somewhere in the apache configuration. Another diagnostic check would be to copy the failing file into the fonts directory and check whether the header is present - this will confirm that the regex or the filename isn't the problem but indicates that it is directory configuration related.

You have stated that there are no other .htaccess files in the document root or children ( this could cause the problem ) and the file is being served just without the headers.

My feeling at this stage is that this may be related to your mod_pagespeed which is disabled for lib/icons. It could even come down to the ordering of the modules being loaded.

Trivially I would first restart your apache just in case. Any caching or proxy infrastructure in between should be disabled. Next I would disable mod_pagespeed and see if the issue remains.

I would also check to see whether there is a block of configuration in either your httpd.conf or the virtual hosts configuration that is similar as it is possible that this is catching some directories and not others and that your .htaccess is not doing what is expected. As a further check I would try removing or temporarily renaming .htaccess ( to htaccess-removed or something similar ) to confirm that the URL request headers are no longer being included using the curl or other approaches to validating the CORS headers.

Probably not related however another thing I'd check is the permissions and ownership of the files and directories - thought worth mentioning just in case.

Also worth checking the error logs on restarting the apache and on making the requests as this may provide further insight.

Upvotes: 2

MrSalmon
MrSalmon

Reputation: 89

What is the full path to your .htaccess file?

Ether your .htaccess file is not set up in a way to have it apply it's rules to files in the https://www.sarahlawrence.edu/_assets/v6/lib/ location, or there is another rule somewhere else superseding the rule you have shown above.

Upvotes: 0

Related Questions