I'm working on a headless website based on Drupal 8; I installed the CORS module and in CORS domain set *|*. Client side can read my view rest endpoint, but when client side try to load a file url returned by views rest result, I am faced with CORS error:

XMLHttpRequest cannot load http://domain.com/sites/default/files/home-slider-slide3-audio/2016-11/tr_SaidNursi.mp3. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://xx.domain.com' is therefore not allowed access.

How can I resolve this problem?

The webserver is Nginx.

2 Answers 2


As this file is public the HTTP request is not served by Drupal. You need to configure your web server to send correct CORS headers. If you are using Apache and have mod_headers installed you can set these HTTP headers in .htaccess file.



As @ya.teck mentioned first it need handled by webserver so puting following lines in your site Nginx Configuration could help

add_header Access-Control-Allow-Origin '$http_origin' always;
add_header Access-Control-Allow-Credentials true always;
add_header Access-Control-Allow-Headers 'Origin, X-Requested-With, Content-Type, Accept, Authorization';
add_header Access-Control-Expose-Headers 'Authorization';

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.