1. I have created a view (via the views module) which outputs a JSON output (minus the template etc) I have loaded the page and it outputs data as required.

  2. I now need to call this page from another domain (cross domain) - however, when I am calling the page from the other domain (through javascript) I am obtaining the common

Failed to load https://<>: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access.

The Query: Where within the views module would I be able to set the 'Access-Control-Allow-Origin' value such that it would either allow all requesting sites to be served the page or only specific domains to be served the page.

Side Note: As things stand I am not able to install other modules on the primary domain where the JSON page resides, as I am restricted to what I can do on that site.

As people of have worked with cross domain access will no doubt have guessed by now I am using the Chrome browser.

Side Note 2: When I use the Chrome extension "Allow-Control-Allow-Origin: *" I am able to load the page as required because the whole access control check is by-passed, but I need the loading functionality to work without the need for such an extension.

1 Answer 1


You can use the https://www.drupal.org/project/cors module to add the allowed domains to your project.

Or you can alter the .htaccess file or change the headers of the php file like described in https://stackoverflow.com/questions/14467673/enable-cors-in-htaccess:

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ /index.php [QSA,L]
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Methods: "GET,POST,OPTIONS,DELETE,PUT"
  • Thanks that has worked, much appreciated. Am I right in assuming 1. that the code in the posting above applies access to all pages on the site? and 2. that I could use something like this <Files "/json_feed">Header set Access-Control-Allow-Origin "*" Header set Access-Control-Allow-Methods: "GET,POST,OPTIONS,DELETE,PUT" </Files> to making the access only applicable to a give page? Also, where would I have to put such code (assuming syntax is correct) in the .htaccess file. Thanks in advance.
    – Mo-ster
    Oct 2, 2017 at 13:21
  • Yes you are right and even from all external domains because of the * wildcard. You can use the <Files "yourpage-url"> tag to allow cross origin sharing for a single page (I haven't tested this in Drupal). Method can be set to GET only.Is set in the IfModule mod_headers.c tag in .htaccess, for example underneath "Header always set X-Content-Type-Options nosniff".
    – JurgenR
    Oct 2, 2017 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.