I have few APIs created in Drupal 7 which uses session authentication. Now when I get the CSRF token and try to use it in my API call, I get following error: Request header field X-CSRF-Token is not allowed by Access-Control-Allow-Headers in preflight response.

Here is my javascript code:

var url = "http://dev/api/v1/macc/*";
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function () {
    if (this.readyState == 4 && this.status == 200) {
xhttp.open("GET", url, true);
// xhttp.setRequestHeader('Content-Type', 'application/json');
xhttp.setRequestHeader('X-CSRF-Token', 'xxxxxxxxxxxxxxxxx');
// xhttp.setRequestHeader('cookie', cookie);


If I run the same API from Advanced Rest Client, I get the correct response.

Any help will be appreciated.

1 Answer 1


Have a look at cors module You'll be able to add necessary Access-Control-Allow-Headers

Otherwise, you can do this by changing your apache (or nginx or whatever) conf.

In drupal 8, you define this in services.yml, as explain here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.