avoiding CORS not working in codeigniter

Question

I am trying to work with AJAX request in my codeigniter app. At the end of my codeigniter controller function, I added

public somefunction(){

 $this->output->set_header('Access-Control-Allow-Origin: *');
 $this->output->set_header('Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE');
 $this->output->set_content_type('application/json');
// plan contains array
 return $this->output->set_output(json_encode($plan));
}

Normal get request works via server to server, but AJax calls shows the error. XMLHttpRequest cannot load localhost:8888. Request header field Content-Type is not allowed by Access-Control-Allow-Headers in preflight response.

Here is the ajax calls

self.information = function() {
      $.ajax({
          type: 'GET',
          url: '',
          contentType: 'application/json; charset=utf-8'
      })
      .done(function(result) {
        console.log(result);
      })
      .fail(function(xhr, status, error) {
          alert(error);
      })
      .always(function(data){
      });
  }

The url works, since I checked it with postman and I get data returned. So no problem with that.

http://stackoverflow.com/questions/20511988/set-cross-domain-in-codeigniter suggests changing the AJAX content type of the request. Maybe worth a try. — apokryfos, Feb 25 '17 at 18:07
By the way is the `header(` part in the `set_header` really there or is it a copy/paste typo? — apokryfos, Feb 25 '17 at 18:17
Though not CI related, [this answer talks about CORs and checking the headers from the server and what to send](http://stackoverflow.com/a/32501365/3585500). — ourmandave, Feb 25 '17 at 18:19
@apokryfos OH yes that was a typo before copying, I fixed it already. — XAF, Feb 25 '17 at 18:31
You need to set "Access-Control-Allow-Headers" headers in your response and include Content-Type to it. — Jannes Botis, Feb 25 '17 at 19:42

score 3 · Answer 1 · answered Feb 27 '17 at 16:56

3

I came across the same issue today, what worked for me was defining the index_options method

public function index_options() {
    return $this->response(NULL, REST_Controller::HTTP_OK);
}

and updating my the constructor to this

public function __construct(){
    parent::__construct();
    header('Access-Control-Allow-Origin: *');
    header("Access-Control-Allow-Headers: X-API-KEY, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method");
    header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE");
}

Unfortunately I'm not familiar enough with access control to explain why this worked for me. Hope this helps.

answered Feb 27 '17 at 16:56

Awad Maharoof

2,260
1
24
36

Hello Awad, so do I add it to my somefunction() ??? How does the whole thing work together? – XAF Feb 28 '17 at 07:48
@Farhana just define the index_options function just like your somefunction function, that will stop the browser from complaining about the preflight OPTIONS request. Next, move the header modifications to the constructor – Awad Maharoof Feb 28 '17 at 08:52
the index_options function is not called anyhow, how will it load? Or the ci automatically loads it ? – XAF Feb 28 '17 at 09:34
Yes, if I'm not mistaken its the browser that calls the index_options function – Awad Maharoof Feb 28 '17 at 09:43
@AwadMaharoof Saved the day! – Shubham Agrawal Aug 31 '23 at 12:39

avoiding CORS not working in codeigniter

1 Answers1