How do I enable CORS?

Question

I want to use services 3 module to create node of a content type in my Drupal 6 website.

I have enabled Services 3 module and configured the Rest Server properly. But when I make a post call to it, the browser converts the POST method into OPTIONS and hence the response that is received is http 411 error. Further more, there is an error in that console about Access-control-allow-origin. This clearly means that this is a CORS issue.

I searched for a way to enable CORS in Drupal 6 and found out that we can enable CORS by adding headers in the .htaccess file. I added the following lines to .htaccess file :

Header set Access-Control-Allow-Origin "*" env=IS_CORS

Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

Header add Access-Control-Allow-Headers "x-requested-with"

Is this the correct way to enable CORS in Drupal 6 site?

Thanks in advance. Please try to guide me through this. I am sure many people must have faced this situation, but I am currently not able to find nice solution to this.

Answer 1

Doing this in an .htaccess should be OK.

Doing it in the Apache config for the host (main httpd.conf, include for the vhost, etc) is better. When you upgrade Drupal, the .htaccess will be nuked. Also, .htaccess is interpreted for every single access; Apache config (including Includes) is compiled when Apache starts.

You can also use drupal_set_header(). You just need to use the right hook for your situation (not terribly familiar with the Services hooks).

drupal_set_header('Access-Control-Allow-Origin: "*" IS_CORS');
drupal_set_header('Access-Control-Allow-Methods: PUT, GET, POST, DELETE, OPTIONS');
drupal_set_header('Access-Control-Allow-Headers: x-requested-with');

You may also want to check out the H5BP Server Configs project. I use bits and pieces of this as Apache includes for my virtual hosts, and I am pretty sure they have some good CORS rules.