Blocked by CORS policy: The 'Access-Control-Allow-Origin' - Mean Stack

Forgive me if you already know this, but I’m giving all the info in case someone else has the same issue…

The CORS Access-Control-Allow-Origin line expects in one of these two formats:

Allow everything: probably not what you want

Access-Control-Allow-Origin: *

Allow a single specific origin:

Access-Control-Allow-Origin: [SCHEME]://[HOST]:[PORT_OPTIONAL]

• Scheme: AKA protocol, this can be HTTP, HTTPS .
• Host: This has to exactly match the requesting origin, so subdomain.domain.com or domain.com
• Port: [Optional, but important for you] Leaving the port out is the same as putting default port :80 if your scheme is HTTP and :443 if your scheme is HTTPS.

So I think the port is causing your issue: your config is currently only allowing requests from origin https://app.getmanagly.com:3008 and you need it to allow requests from https://app.getmanagly.com AKA https://app.getmanagly.com:443

Solution: you have three options

1. Allow everything (might be helpful for testing, but not suggested)

Header set Access-Control-Allow-Origin: *

2. Remove the port (3008) to the CORS header in your apache config, so you ONLY allow requests from https://app.getmanagly.com

Header set Access-Control-Allow-Origin: https://app.getmanagly.com

3. Update Apache config to dynamically mirror the port of the requesting origin. This gets ugly because you can’t add multiple domains in Access-Control-Allow-Origin, so you have to dynamically set the header to match the requesting origin

SetEnvIf Origin "https://app.getmanagly.com(:3008)?$" AccessControlAllowOrigin=$0
Header set Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin

FINAL IMPORTANT STEPS:

In order for this to take effect, you need to reload apache AND enable headers

1. Confirming that the config is valid apachectl -t
2. If valid reload Apache sudo service apache2 reload or apachectl -k graceful
3. Ensure mod_headers (Apache module that allows you to alter headers) is enabled by running a2enmod headers

Forgive me if you already know this, but I’m giving all the info in case someone else has the same issue…

The CORS Access-Control-Allow-Origin line expects in one of these two formats:

Allow everything: probably not what you want

Access-Control-Allow-Origin: *

Allow a single specific origin:

Access-Control-Allow-Origin: [SCHEME]://[HOST]:[PORT_OPTIONAL]

• Scheme: AKA protocol, this can be HTTP, HTTPS .
• Host: This has to exactly match the requesting origin, so subdomain.domain.com or domain.com
• Port: [Optional, but important for you] Leaving the port out is the same as putting default port :80 if your scheme is HTTP and :443 if your scheme is HTTPS.

So I think the port is causing your issue: your config is currently only allowing requests from origin https://app.getmanagly.com:3008 and you need it to allow requests from https://app.getmanagly.com AKA https://app.getmanagly.com:443

Solution: you have three options

1. Allow everything (might be helpful for testing, but not suggested)

Header set Access-Control-Allow-Origin: *

2. Remove the port (3008) to the CORS header in your apache config, so you ONLY allow requests from https://app.getmanagly.com

Header set Access-Control-Allow-Origin: https://app.getmanagly.com

3. Update Apache config to dynamically mirror the port of the requesting origin. This gets ugly because you can’t add multiple domains in Access-Control-Allow-Origin, so you have to dynamically set the header to match the requesting origin

SetEnvIf Origin "https://app.getmanagly.com(:3008)?$" AccessControlAllowOrigin=$0
Header set Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin

FINAL IMPORTANT STEPS:

In order for this to take effect, you need to reload apache AND enable headers

1. Confirming that the config is valid apachectl -t
2. If valid reload Apache sudo service apache2 reload or apachectl -k graceful
3. Ensure mod_headers (Apache module that allows you to alter headers) is enabled by running a2enmod headers

Forgive me if you already know this, but I’m giving all the info in case someone else has the same issue…

The CORS Access-Control-Allow-Origin line expects in one of these two formats:

Allow everything: probably not what you want

Access-Control-Allow-Origin: *

Allow a single specific origin:

Access-Control-Allow-Origin: [SCHEME]://[HOST]:[PORT_OPTIONAL]

• Scheme: AKA protocol, this can be HTTP, HTTPS .
• Host: This has to exactly match the requesting origin, so subdomain.domain.com or domain.com
• Port: [Optional, but important for you] Leaving the port out is the same as putting default port :80 if your scheme is HTTP and :443 if your scheme is HTTPS.

So I think the port is causing your issue: your config is currently only allowing requests from origin https://app.getmanagly.com:3008 and you need it to allow requests from https://app.getmanagly.com AKA https://app.getmanagly.com:443

Solution: you have three options

1. Allow everything (might be helpful for testing, but not suggested)

Header set Access-Control-Allow-Origin: *

2. Remove the port (3008) to the CORS header in your apache config, so you ONLY allow requests from https://app.getmanagly.com

Header set Access-Control-Allow-Origin: https://app.getmanagly.com

3. Update Apache config to dynamically mirror the port of the requesting origin. This gets ugly because you can’t add multiple domains in Access-Control-Allow-Origin, so you have to dynamically set the header to match the requesting origin

SetEnvIf Origin "https://app.getmanagly.com(:3008)?$" AccessControlAllowOrigin=$0
Header set Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin

FINAL IMPORTANT STEPS:

In order for this to take effect, you need to reload apache AND enable headers

1. Confirming that the config is valid apachectl -t
2. If valid reload Apache sudo service apache2 reload or apachectl -k graceful
3. Ensure mod_headers (Apache module that allows you to alter headers) is enabled by running a2enmod headers

Forgive me if you already know this, but I’m giving all the info in case someone else has the same issue…

The CORS Access-Control-Allow-Origin line expects in one of these two formats:

Allow everything: probably not what you want

Access-Control-Allow-Origin: *

Allow a single specific origin:

Access-Control-Allow-Origin: [SCHEME]://[HOST]:[PORT_OPTIONAL]

• Scheme: AKA protocol, this can be HTTP, HTTPS .
• Host: This has to exactly match the requesting origin, so subdomain.domain.com or domain.com
• Port: [Optional, but important for you] Leaving the port out is the same as putting default port :80 if your scheme is HTTP and :443 if your scheme is HTTPS.

So I think the port is causing your issue: your config is currently only allowing requests from origin https://app.getmanagly.com:3008 and you need it to allow requests from https://app.getmanagly.com AKA https://app.getmanagly.com:443

Solution: you have three options

1. Allow everything (might be helpful for testing, but not suggested)

Header set Access-Control-Allow-Origin: *

2. Remove the port (3008) to the CORS header in your apache config, so you ONLY allow requests from https://app.getmanagly.com

Header set Access-Control-Allow-Origin: https://app.getmanagly.com

3. Update Apache config to dynamically mirror the port of the requesting origin. This gets ugly because you can’t add multiple domains in Access-Control-Allow-Origin, so you have to dynamically set the header to match the requesting origin

SetEnvIf Origin "https://app.getmanagly.com(:3008)?$" AccessControlAllowOrigin=$0
Header set Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin

FINAL IMPORTANT STEPS:

In order for this to take effect, you need to reload apache AND enable headers

1. Confirming that the config is valid apachectl -t
2. If valid reload Apache sudo service apache2 reload or apachectl -k graceful
3. Ensure mod_headers (Apache module that allows you to alter headers) is enabled by running a2enmod headers

@aha any luck over the problem …still stuck with this for long time :(