Access-Control-Allow-Origin headers not working - apache

Even though I've added this in my .htaccess file:
Header add Access-Control-Allow-Origin "*"
And this in my apache config: (Inside a section AND outside)
<Files ~ "\.(gif|jpe?g|png|js|json|xml)$">
Header set Access-Control-Allow-Origin "*"
</Files>
It still does not work!
When I get the DIRECTORY it does give me the wanted header, but as soon as I download a specific file the header is nowhere to be found!
How hard can it be?

try
<FilesMatch "\.(gif|jpe?g|png|js|json|xml)$">
<IfModule mod_headers.c>
Header set Access-Control-Allow-Origin "*"
</IfModule>
</FilesMatch>

Related

HTTP headers (for cache-control)

Is this statement correct?
css and js should use private for proxy caching
https://developers.google.com/speed/docs/best-practices/caching#LeverageProxyCaching
I'm intending to use this directly for my hosting and alt. through a CDN, and wish to have the best settings for speed optimization, TTFB.
<IfModule mod_headers.c>
Header set Connection keep-alive
<filesmatch "\.(ico|flv|gif|swf|eot|woff|otf|ttf|svg)$">
Header set Cache-Control "max-age=2592000, public"
</filesmatch>
<filesmatch "\.(jpg|jpeg|png)$">
Header set Cache-Control "max-age=1209600, public"
</filesmatch>
# css and js should use private for proxy caching https://developers.google.com/speed/docs/best-practices/caching#LeverageProxyCaching
<filesmatch "\.(css)$">
Header set Cache-Control "max-age=31536000, private"
</filesmatch>
<filesmatch "\.(js)$">
Header set Cache-Control "max-age=1209600, private"
</filesmatch>
<filesMatch "\.(x?html?|php)$">
Header set Cache-Control "max-age=600, private, must-revalidate"
</filesMatch>

Access-Control-Allow-Origin not working at all

I have an error when try to put my chat on my webiste
Failed to load
https://chat.example.com/socket.io/?EIO=3&transport=polling&t=MBK-pzZ:
No 'Access-Control-Allow-Origin' header is present on the requested
resource. Origin 'https://example.com' is therefore not allowed access.
The response had HTTP status code 503.
on my VH on apache I did:
<VirtualHost 1.1.1.1:443>
SSLEngine on
ServerName www.example.com
ServerAlias www.example.com example.com
ServerAdmin webmaster#example.com
DocumentRoot /home/myuser/public_html
UseCanonicalName OFF
<Directory /home/myuser/public_html>
Options None
Options +FollowSymLinks
Header add Access-Control-Allow-Origin "*"
Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"
</Directory>
</VirtualHost>
but it's not help.
using apache 2.4
thanks
It was with my apache configuration the "httpd-default.conf"
I found this 2 lines:
Header set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Origin "*"
when i remove it, it's works
thanks!
You can also put these lines in .htacces file to fix this issue.
Header add Access-Control-Allow-Origin "*"
Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

GWT cache config via Apache 2.2 httpd.conf?

The GWT perfect caching documntation (http://www.gwtproject.org/doc/latest/DevGuideCompilingAndDebugging.html#perfect_caching) suggests to add the following lines to my .htaccess file:
<Files *.nocache.*>
ExpiresActive on
ExpiresDefault "now"
Header merge Cache-Control "public, max-age=0, must-revalidate"
</Files>
<Files *.cache.*>
ExpiresActive on
ExpiresDefault "now plus 1 year"
</Files>
As I'm not using .htaccess files but have access to the Apache 2.2 httpd.conf file I would prefer to add those lines there.
But where / how?
Thanks for any advice.
The documentation for the <Files> directive clearly states where you can use it:
Context: server config, virtual host, directory, .htaccess
In most cases, you'd probably want to add it to your application's virtual host (if you want the caching rules to apply only to that application) or the server's config (outside any directive, usually in httpd.conf) - if you want to apply those rules globally (useful if you have more than one GWT application on the server).
If you want to use it in a virtual host directive:
<VirtualHost *:80>
ServerName host.example.com
#...
<Files *.nocache.*>
ExpiresActive on
ExpiresDefault "now"
Header merge Cache-Control "public, max-age=0, must-revalidate"
</Files>
<Files *.cache.*>
ExpiresActive on
ExpiresDefault "now plus 1 year"
</Files>
</VirtualHost>
If you want to use them globally, just put them in httpd.conf, outside of any directives.

.htaccess <filesMatch> only if host name matches?

I just setted up a local environament with same code that I had in production environament into a vagrant virtual machine with ubuntu32,
The thing is that I got Internal Server Error with all my rules in the .htaccess file
So I started removing separated blocks of code and this was the trouble:
# 1 weeks
<FilesMatch "\.(js|css)$">
Header set Cache-Control "max-age=604800, public"
</FilesMatch>
# 1 weeks
<FilesMatch "\.(ico|pdf|flv|jpg|jpeg|png|gif|swf)$">
Header set Cache-Control "max-age=604800, public"
</FilesMatch>
# 1 MIN
<FilesMatch "\.(html|htm|php)$">
Header set Cache-Control "max-age=60, private, proxy-revalidate"
</FilesMatch>
The thing is that I would like to use the exact same code for all environaments, is there a way I can only include that block of <filesMatch> only if not in localhost?
I found this answer but it just refers to a page, not the host name.
You can probably do:
SetEnvIf Host ^ NON_LOCAL
SetEnvIf Host localhost !NON_LOCAL
<FilesMatch "\.(js|css)$">
Header set Cache-Control "max-age=604800, public" env=NON_LOCAL
</FilesMatch>
# 1 weeks
<FilesMatch "\.(ico|pdf|flv|jpg|jpeg|png|gif|swf)$">
Header set Cache-Control "max-age=604800, public" env=NON_LOCAL
</FilesMatch>
# 1 MIN
<FilesMatch "\.(html|htm|php)$">
Header set Cache-Control "max-age=60, private, proxy-revalidate" env=NON_LOCAL
</FilesMatch>

.htaccess cache-control doesn't cache my files (js|png|css etc.)

As my title says, I am trying to cache-control the content on my website but it seems that my content isn't being cached.
This is my code in my .htaccess file:
Header unset Pragma
FileETag None
Header unset ETag
# cache images/pdf docs for 10 days
<FilesMatch "\.(ico|pdf|jpg|jpeg|png|gif|js)$">
Header set Cache-Control "max-age=864000, public, must-revalidate"
Header unset Last-Modified
</FilesMatch>
# cache html/htm/xml/txt diles for 2 hours
<FilesMatch "\.(html|htm|xml|txt|xsl)$">
Header set Cache-Control "max-age=7200, must-revalidate"
</FilesMatch>
I have tried a lot of tutorials but none of them seems to do the trick.
By the way, other .htaccess codes, like redirecting and stuff, DOES work.
I figured it out, you gotta remove Header unset Last-Modified
Header unset Pragma
FileETag None
Header unset ETag
# cache images/pdf docs for 10 days
<FilesMatch "\.(ico|pdf|jpg|jpeg|png|gif|js)$">
Header set Cache-Control "max-age=864000, public, must-revalidate"
</FilesMatch>
# cache html/htm/xml/txt files for 2 hours
<FilesMatch "\.(html|htm|xml|txt|xsl)$">
Header set Cache-Control "max-age=7200, must-revalidate"
</FilesMatch>