Getting request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource

Question

I am trying to send an Ajax request to a Tomcat server from my application, but I am getting this error (my web app is running on Chrome):

Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access. The response had HTTP status code 403.

I have tried using

'Access-Control-Allow-Origin' : 'http://localhost:8080/app',

but it didn't work.

My Ajax code:

 var arr = [1];
   $.ajax({ 
   url: 'http://localhost:8080/app',
   type: 'POST',
   contentType:'application/json',
   headers: {
   'Access-Control-Allow-Origin' : 'http://localhost:8080',
   },
       data: JSON.stringify(arr[0]),
       success: function(data){
        //On ajax success do this
             alert(data);
          }
     });

since you're not really using the response, you could use a plain old
tag to send the data instead of ajax, which should work without modifying the server, — dandavis, Nov 20 '15 at 06:20
what happens if the REST endpoint is something i cannot control — PirateApp, Oct 04 '16 at 13:06

score 35 · Accepted Answer · edited Feb 11 '16 at 03:04

35

Basically, to make a cross domain AJAX requests, the requested server should allow the cross origin sharing of resources (CORS). You can read more about that from here: http://www.html5rocks.com/en/tutorials/cors/

In your scenario, you are setting the headers in the client which in fact needs to be set into http://localhost:8080/app server side code.

If you are using PHP Apache server, then you will need to add following in your .htaccess file:

Header set Access-Control-Allow-Origin "*"

edited Feb 11 '16 at 03:04

falsarella

12,217
9
69
115

answered Nov 20 '15 at 06:55

Chandan

1,128
9
11

http://stackoverflow.com/questions/41854438/how-to-use-api-key-along-with-cors-in-web-api I am trying to use CORS along with an extra security but it's not working. Any idea? – Si8 Jan 25 '17 at 14:47
The OP said he's using Tomcat – Pere Mar 07 '17 at 09:13
I have same issue bu that apis can return success when i cuse crul but in ajax shows this error? – Araf Jan 19 '18 at 18:09
I have same issue bu that apis can return success when i cuse crul but in ajax shows this error? – Araf Jan 19 '18 at 18:10
Doesn't this allow all origins? Shouldn't that really be limited to the expected origins? – QuietSeditionist Feb 06 '18 at 17:39

score 10 · Answer 2 · answered Jun 20 '16 at 14:22

In case of Request to a REST Service:

You need to allow the CORS (cross origin sharing of resources) on the endpoint of your REST Service with Spring annotation:

@CrossOrigin(origins = "http://localhost:8080")

Very good tutorial: https://spring.io/guides/gs/rest-service-cors/

Getting request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource

2 Answers2

Linked