CODEWITHSUNDEEP
javascriptangularjsasp.net-web-apicors
kob490
kob490

Reputation: 3317

Web API CORS does not return correct Access-Control-Allow-Origin header

Trying to understand and debug an issue with a CORS setup on WebAPI 2. My front-end angular/javascript application communicates with my API at

http://api.example.com/api/items/GetAll

which sometimes returns the following error:

The 'Access-Control-Allow-Origin' header has a value 'http://example.com' that is not equal to the supplied origin. Origin 'http://www.example.com' is therefore not allowed access.

Testing the api link on Fiddler returns the following in the headers:

Access-Control-Allow-Origin: http://example.com

Why would this happen and how do I address this situation?

Upvotes: 0

Views: 638

Answers (1)

Seany84
Seany84

Reputation: 5596

It appears that you have calls to both types of domain/URL in your client-side code.

Based on that assumption, CORS should be specified for both domains i.e.

http://example.com 
http://www.example.com

References:

  1. https://www.w3.org/TR/cors/#access-control-allow-origin-response-header
  2. Access-Control-Allow-Origin wildcard subdomains, ports and protocols

Upvotes: 1

Related Questions