Blocked by CORS policy: The 'Access-Control-Allow-Origin' - Mean Stack

@aha any luck over the problem …still stuck with this for long time :(

Forgive me if you already know this, but I’m giving all the info in case someone else has the same issue…

The CORS Access-Control-Allow-Origin line expects in one of these two formats:

Allow everything: probably not what you want

Access-Control-Allow-Origin: *

Allow a single specific origin:

Access-Control-Allow-Origin: [SCHEME]://[HOST]:[PORT_OPTIONAL]

• Scheme: AKA protocol, this can be HTTP, HTTPS .
• Host: This has to exactly match the requesting origin, so subdomain.domain.com or domain.com
• Port: [Optional, but important for you] Leaving the port out is the same as putting default port :80 if your scheme is HTTP and :443 if your scheme is HTTPS.

So I think the port is causing your issue: your config is currently only allowing requests from origin https://app.getmanagly.com:3008 and you need it to allow requests from https://app.getmanagly.com AKA https://app.getmanagly.com:443

Solution: you have three options

1. Allow everything (might be helpful for testing, but not suggested)

Header set Access-Control-Allow-Origin: *

2. Remove the port (3008) to the CORS header in your apache config, so you ONLY allow requests from https://app.getmanagly.com

Header set Access-Control-Allow-Origin: https://app.getmanagly.com

3. Update Apache config to dynamically mirror the port of the requesting origin. This gets ugly because you can’t add multiple domains in Access-Control-Allow-Origin, so you have to dynamically set the header to match the requesting origin

SetEnvIf Origin "https://app.getmanagly.com(:3008)?$" AccessControlAllowOrigin=$0
Header set Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin

FINAL IMPORTANT STEPS:

In order for this to take effect, you need to reload apache AND enable headers

1. Confirming that the config is valid apachectl -t
2. If valid reload Apache sudo service apache2 reload or apachectl -k graceful
3. Ensure mod_headers (Apache module that allows you to alter headers) is enabled by running a2enmod headers