CORS policy: No 'Access-Control-Allow-Origin'

Question

I have two sites. On the first, I created a REST export page with information I need on the second one. I got this working for some years, but since my last update to Drupal 9.4.4 and from PHP 7 to PHP 8, it doesn't anymore.

The full error message is the following.

Access to XMLHttpRequest at 'https://site1.com/json/site1-agenda?today=08042022&_format=json' from origin 'https://site2.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

On the first site, I have the following CORS information in services.yml.

enabled: true
# Specify allowed headers, like 'x-allowed-header'.
allowedHeaders: ['*']
# Specify allowed request methods, specify ['*'] to allow all possible ones.
allowedMethods: ['GET']
# Configure requests allowed from specific origins.
allowedOrigins: ['https://site2.com']
# Sets the Access-Control-Expose-Headers header.
exposedHeaders: true
# Sets the Access-Control-Max-Age header.
maxAge: true
# Sets the Access-Control-Allow-Credentials header.
supportsCredentials: true

Is there anything wrong with my setup? Or a way to debug this?

Answer 1

Try this:

On my site1.local following info in services.yml file.

  cors.config:
    enabled: true
    # Specify allowed headers, like 'x-allowed-header'.
    allowedHeaders: ['x-csrf-token','authorization','content-type','accept','origin','x-requested-with']
    # Specify allowed request methods, specify ['*'] to allow all possible ones.
    allowedMethods: ['*']
    # Configure requests allowed from specific origins.
    allowedOrigins:  ['http://site2.local']
    # Sets the Access-Control-Expose-Headers header.
    exposedHeaders: false
    # Sets the Access-Control-Max-Age header.
    maxAge: 1000
    # Sets the Access-Control-Allow-Credentials header.
    supportsCredentials: true

and in my site2.local

services.yml file

  cors.config:
    enabled: true
    # Specify allowed headers, like 'x-allowed-header'.
    allowedHeaders: ['x-csrf-token','authorization','content-type','accept','origin','x-requested-with']
    # Specify allowed request methods, specify ['*'] to allow all possible ones.
    allowedMethods: ['*']
    # Configure requests allowed from specific origins.
    allowedOrigins:  ['http://site1.local']
    # Sets the Access-Control-Expose-Headers header.
    exposedHeaders: false
    # Sets the Access-Control-Max-Age header.
    maxAge: 1000
    # Sets the Access-Control-Allow-Credentials header.
    supportsCredentials: true

it works for me.

Answer 2

In services.yml, update exposedHeaders under cors.config to an array.

exposedHeaders: []

I had the same issue, and I found that it is related to PHP 8.1 and the 'asm89/stack-cors' dependency not being updated.