0

I have two sites. On the first, I created a REST export page with information I need on the second one. I got this working for some years, but since my last update to Drupal 9.4.4 and from PHP 7 to PHP 8, it doesn't anymore.

The full error message is the following.

Access to XMLHttpRequest at 'https://site1.com/json/site1-agenda?today=08042022&_format=json' from origin 'https://site2.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

On the first site, I have the following CORS information in services.yml.

enabled: true
# Specify allowed headers, like 'x-allowed-header'.
allowedHeaders: ['*']
# Specify allowed request methods, specify ['*'] to allow all possible ones.
allowedMethods: ['GET']
# Configure requests allowed from specific origins.
allowedOrigins: ['https://site2.com']
# Sets the Access-Control-Expose-Headers header.
exposedHeaders: true
# Sets the Access-Control-Max-Age header.
maxAge: true
# Sets the Access-Control-Allow-Credentials header.
supportsCredentials: true

Is there anything wrong with my setup? Or a way to debug this?

2
  • The Drupal update and PHP version update was on which site? From which Drupal version? Aug 4, 2022 at 8:42
  • Both sites they are both on 9.4.4 i don’t know from what version it was updated
    – Joost
    Aug 4, 2022 at 9:53

2 Answers 2

2

Try this:

On my site1.local following info in services.yml file.

  cors.config:
    enabled: true
    # Specify allowed headers, like 'x-allowed-header'.
    allowedHeaders: ['x-csrf-token','authorization','content-type','accept','origin','x-requested-with']
    # Specify allowed request methods, specify ['*'] to allow all possible ones.
    allowedMethods: ['*']
    # Configure requests allowed from specific origins.
    allowedOrigins:  ['http://site2.local']
    # Sets the Access-Control-Expose-Headers header.
    exposedHeaders: false
    # Sets the Access-Control-Max-Age header.
    maxAge: 1000
    # Sets the Access-Control-Allow-Credentials header.
    supportsCredentials: true

and in my site2.local

services.yml file

  cors.config:
    enabled: true
    # Specify allowed headers, like 'x-allowed-header'.
    allowedHeaders: ['x-csrf-token','authorization','content-type','accept','origin','x-requested-with']
    # Specify allowed request methods, specify ['*'] to allow all possible ones.
    allowedMethods: ['*']
    # Configure requests allowed from specific origins.
    allowedOrigins:  ['http://site1.local']
    # Sets the Access-Control-Expose-Headers header.
    exposedHeaders: false
    # Sets the Access-Control-Max-Age header.
    maxAge: 1000
    # Sets the Access-Control-Allow-Credentials header.
    supportsCredentials: true

it works for me.

2
  • thanks and sorry but this doesn't makes sence to me. in allowedheaders you have an aterix at the end but this means all, so why write out all the other stuff in front of it. and why set the cors on the second site if getting info from site 1 from site 2 the cors should only on site 1 right? anyway I tried your code but this doesn't solve the issue.
    – Joost
    Sep 5, 2022 at 12:09
  • oh, forget to remove asterisk. removed and checked its working fine for me.
    – Lokesh1024
    Sep 5, 2022 at 12:25
1

In services.yml, update exposedHeaders under cors.config to an array.

exposedHeaders: []

I had the same issue, and I found that it is related to PHP 8.1 and the 'asm89/stack-cors' dependency not being updated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.