Following from my previous question Is it safe to fix Access-Control-Allow-Origin (CORS origin) errors with a php header directive?

The only solution that worked for me was:

header("Access-Control-Allow-Origin: http://mozilla.com");

However, I have 4 subdomains that I need to enable them to access the data on the main domain.

I tried to repeat the command, like this:

header("Access-Control-Allow-Origin: http://site1.com");
header("Access-Control-Allow-Origin: http://site2.com");
header("Access-Control-Allow-Origin: http://site3.com");

but it did not work.

I tried the solution posted by @yesthatguy in this response to this question: Access-Control-Allow-Origin Multiple Origin Domains?

I used this code:

<IfModule mod_headers.c>
SetEnvIf Origin "http(s)?://(www\.)?(audio.coptic-treasures.com|video.coptic-treasures.com|text.coptic-treasures.com)$" AccessControlAllowOrigin=$0$1
Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
Header set Access-Control-Allow-Credentials true

But it did not work. I get the following error:

XMLHttpRequest cannot load https://coptic-treasures.com/wp-json/frm/v2/forms/6?return=html. The 'Access-Control-Allow-Origin' header contains multiple values 'https://audio.coptic-treasures.com, https://audio.coptic-treasures.coms', but only one is allowed. Origin 'https://audio.coptic-treasures.com' is therefore not allowed access.

I do not have a duplication of any urls.

Then I read in the W3.org article regarding CORS, section 6.4 the following:

Resources that wish to enable themselves to be shared with multiple Origins but do not respond uniformly with "*" must in practice generate the Access-Control-Allow-Origin header dynamically in response to every request they wish to allow. As a consequence, authors of such resources should send a Vary: Origin HTTP header or provide other appropriate control directives to prevent caching of such responses, which may be inaccurate if re-used across-origins.

I appreciate any help in implementing the w3.org recommendations.

Also, I don't currently have any caching or CDN, but in the live site, both will be active.

Thanks in advance.

  • @Mark. Thanks for your comprehensive comment. I have a form that has thousand of entries and I want to use it in 5 subdomains, it is not efficient to keep updateing 5 forms. I started this project based on the plugin developer documentation that the forms can be shown on many sites. But if it will post security risk, then I will have to go through the exercise of building the 5 forms in parallel and keep updating the entries in parallel. I am not familiar with server to server rest api. Thanks for highlighting the potential of such big security concern. – Atef Wagih Oct 14 '16 at 10:12
  • hmm deleted my previous comment as it seemed to be too much about the previous question :( anyway, why not an iframe? – Mark Kaplun Oct 14 '16 at 10:18
  • and obviously, you can try asking the author, if they say something can be done they have probably more experiance with it than most other people – Mark Kaplun Oct 14 '16 at 10:21
  • The forms process data from its thousands of entries. I will try an iframe and see the results. As for the developers, I contacted them, but they gave me the wildcard code that will open my website to the whole webheader("Access-Control-Allow-Origin: *"); – Atef Wagih Oct 14 '16 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.