How to setup a working and secure CORS configuration for apache2.4?

Question

Currently, I have this config in my apache2.4 virtualhost:

Header always append Access-Control-Allow-Origin "https://www.testdomain.local"
Header always append Access-Control-Allow-Origin "https://testdomain.local"
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
Header always set Access-Control-Max-Age "1000"
Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"

RewriteEngine on

RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=200,L]

However I keep getting this error:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://www.testdomain.local/ads?_=1572477483136. (Reason: CORS header ‘Access-Control-Allow-Origin’ does not match ‘https://www.testdomain.local, https://testdomain.local’).

I know i can fix this by setting the Access-Control-Allow-Origin to a wildcard but that is not secure.

Your apache config is setting the Access-Control-Allow-Origin header twice — in the first two lines. You can’t do that. If you set it twice, browsers combine the values, so the browser ends up seeing it as having two values. But browsers only allow it to have a single value. That’s what the browser is telling you in that error message. — sideshowbarker, Oct 30 '19 at 22:49
Right, I agree. Changing it to "append" still doesn't fix this issue as per the documentation: https://httpd.apache.org/docs/current/mod/mod_headers.html — Dan, Oct 30 '19 at 22:52

score 0 · Answer 1 · answered Oct 30 '19 at 23:31

I was able to solve it by using this config:

SetEnvIf Origin "http(s)?://(.+\.)?testdomain\.local$" CORS=$0
Header always set Access-Control-Allow-Origin "%{CORS}e" env=CORS
Header always merge Vary "Origin"
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS"
Header always set Access-Control-Max-Age "1000"
Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"

RewriteEngine on

RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=200,L]

How to setup a working and secure CORS configuration for apache2.4?

1 Answers1