I have front-end with AngularJS and its connected to drupal backend. I am using drupal services module for rest api.

I have an angularjs web app in subdomain [admin.example.com]. My authentication subdomain [account.example.com] developed with drupal 7.

I can login successfully to account.example.com from admin.example.com using http request from angularjs, so I stored newly generated token. But when i try to collect user data from [account.example.com] using previously stored token, i get 403 status. I'm sure my token is correct.

This work well with chrome disable-web-security mode, when i try from regular mode its response me 403. but i did not get any cors error.

Someone please help me, i'm stack on this stage...

My Apache Conf file [account.example.com]:

<VirtualHost *:80>
    ServerName account.example.com
    ServerAlias account.example.com
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/example_account

    <Directory "/var/www/example_account">
        AllowOverride All
        Require all granted
        Header always set Access-Control-Allow-Origin "*"
        Header always set Access-Control-Allow-Headers "Content-Type, Accept, Authorization, X-CSRF-Token"
        Header always set Access-Control-Allow-Methods "GET,POST"
        Header always set Access-Control-Allow-Credentials true

        #RewriteEngine On
        #RewriteCond %{REQUEST_METHOD} OPTIONS
        #RewriteRule ^(.*)$ $1 [R=200,L]

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

Here is header requests:

enter image description here enter image description here

  • Looks like a CORS issue - see drupal.stackexchange.com/questions/162473/…
    – rémy
    Commented Nov 1, 2020 at 17:04
  • @rémy I have already enabled cors, see my conf file configs above. Is it wrong?
    – Tazim
    Commented Nov 2, 2020 at 9:06
  • Access-Control-Allow-Origin: * should be changed to be specific, like Access-Control-Allow-Origin: admin.example.com
    – rémy
    Commented Nov 2, 2020 at 19:50

1 Answer 1


Try to be specific with the ACAO header, like

Access-Control-Allow-Origin: admin.example.com

The wildcard is not really appreciated, browsers may treat this as high security risk and block the request.

  • I have applied this method. I've used this same api for web and Cordoba both applications, will it work for cordova request if i fixed for admin.example.com?
    – Tazim
    Commented Nov 3, 2020 at 15:35
  • Depends where this cordova request comes from, if you have requests to your API from several domains, you could follow this approach here: stackoverflow.com/questions/1653308/…
    – rémy
    Commented Nov 3, 2020 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.