CORS error in reading file

Question

I'm working on a headless website based on Drupal 8; I installed the CORS module and in CORS domain set *|*. Client side can read my view rest endpoint, but when client side try to load a file url returned by views rest result, I am faced with CORS error:

XMLHttpRequest cannot load http://domain.com/sites/default/files/home-slider-slide3-audio/2016-11/tr_SaidNursi.mp3. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://xx.domain.com' is therefore not allowed access.

How can I resolve this problem?

The webserver is Nginx.

Answer 1

As this file is public the HTTP request is not served by Drupal. You need to configure your web server to send correct CORS headers. If you are using Apache and have mod_headers installed you can set these HTTP headers in .htaccess file.

http://enable-cors.org/server_apache.html

Answer 2

As @ya.teck mentioned first it need handled by webserver so puting following lines in your site Nginx Configuration could help

add_header Access-Control-Allow-Origin '$http_origin' always;
add_header Access-Control-Allow-Credentials true always;
add_header Access-Control-Allow-Headers 'Origin, X-Requested-With, Content-Type, Accept, Authorization';
add_header Access-Control-Expose-Headers 'Authorization';