I have front-end with AngularJS and its connected to drupal backend. I am using drupal services module for rest api.

I have an angularjs web app in subdomain [admin.example.com]. My authentication subdomain [account.example.com] developed with drupal 7.

I can login successfully to account.example.com from admin.example.com using http request from angularjs, so I stored newly generated token. But when i try to collect user data from [account.example.com] using previously stored token, i get 403 status. I'm sure my token is correct.

This work well with chrome disable-web-security mode, when i try from regular mode its response me 403. but i did not get any cors error.

Someone please help me, i'm stack on this stage...

My Apache Conf file [account.example.com]:

<VirtualHost *:80>
    ServerName account.example.com
    ServerAlias account.example.com
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/example_account

    <Directory "/var/www/example_account">
        AllowOverride All
        Require all granted
        Header always set Access-Control-Allow-Origin "*"
        Header always set Access-Control-Allow-Headers "Content-Type, Accept, Authorization, X-CSRF-Token"
        Header always set Access-Control-Allow-Methods "GET,POST"
        Header always set Access-Control-Allow-Credentials true

        #RewriteEngine On
        #RewriteCond %{REQUEST_METHOD} OPTIONS
        #RewriteRule ^(.*)$ $1 [R=200,L]

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

Here is header requests:

enter image description here enter image description here

  • Looks like a CORS issue - see drupal.stackexchange.com/questions/162473/…
    – rémy
    Nov 1 '20 at 17:04
  • @rémy I have already enabled cors, see my conf file configs above. Is it wrong?
    – Tazim
    Nov 2 '20 at 9:06
  • Access-Control-Allow-Origin: * should be changed to be specific, like Access-Control-Allow-Origin: admin.example.com
    – rémy
    Nov 2 '20 at 19:50

Try to be specific with the ACAO header, like

Access-Control-Allow-Origin: admin.example.com

The wildcard is not really appreciated, browsers may treat this as high security risk and block the request.

  • I have applied this method. I've used this same api for web and Cordoba both applications, will it work for cordova request if i fixed for admin.example.com?
    – Tazim
    Nov 3 '20 at 15:35
  • Depends where this cordova request comes from, if you have requests to your API from several domains, you could follow this approach here: stackoverflow.com/questions/1653308/…
    – rémy
    Nov 3 '20 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.