View outputs Access-Control-Allow-Origin header

Question

1. I have created a view (via the views module) which outputs a JSON output (minus the template etc) I have loaded the page and it outputs data as required.

2. I now need to call this page from another domain (cross domain) - however, when I am calling the page from the other domain (through javascript) I am obtaining the common

Failed to load https://<>: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access.

The Query: Where within the views module would I be able to set the 'Access-Control-Allow-Origin' value such that it would either allow all requesting sites to be served the page or only specific domains to be served the page.

Side Note: As things stand I am not able to install other modules on the primary domain where the JSON page resides, as I am restricted to what I can do on that site.

As people of have worked with cross domain access will no doubt have guessed by now I am using the Chrome browser.

Side Note 2: When I use the Chrome extension "Allow-Control-Allow-Origin: *" I am able to load the page as required because the whole access control check is by-passed, but I need the loading functionality to work without the need for such an extension.

Answer 1

You can use the https://www.drupal.org/project/cors module to add the allowed domains to your project.

Or you can alter the .htaccess file or change the headers of the php file like described in https://stackoverflow.com/questions/14467673/enable-cors-in-htaccess:

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ /index.php [QSA,L]
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Methods: "GET,POST,OPTIONS,DELETE,PUT"