Why authenticate request returned 403 after successful login?

Question

I have front-end with AngularJS and its connected to drupal backend. I am using drupal services module for rest api.

I have an angularjs web app in subdomain [admin.example.com]. My authentication subdomain [account.example.com] developed with drupal 7.

I can login successfully to account.example.com from admin.example.com using http request from angularjs, so I stored newly generated token. But when i try to collect user data from [account.example.com] using previously stored token, i get 403 status. I'm sure my token is correct.

This work well with chrome disable-web-security mode, when i try from regular mode its response me 403. but i did not get any cors error.

Someone please help me, i'm stack on this stage...

My Apache Conf file [account.example.com]:

<VirtualHost *:80>
    ServerName account.example.com
    ServerAlias account.example.com
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/example_account

    <Directory "/var/www/example_account">
        AllowOverride All
        Require all granted
        Header always set Access-Control-Allow-Origin "*"
        Header always set Access-Control-Allow-Headers "Content-Type, Accept, Authorization, X-CSRF-Token"
        Header always set Access-Control-Allow-Methods "GET,POST"
        Header always set Access-Control-Allow-Credentials true
    </Directory>

        #RewriteEngine On
        #RewriteCond %{REQUEST_METHOD} OPTIONS
        #RewriteRule ^(.*)$ $1 [R=200,L]

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Here is header requests:

Answer 1

Try to be specific with the ACAO header, like

Access-Control-Allow-Origin: admin.example.com

The wildcard is not really appreciated, browsers may treat this as high security risk and block the request.