# Access-Control-Allow-Origin is there, but isn't working!
**URL:** https://meta.discourse.org/t/access-control-allow-origin-is-there-but-isnt-working/49164
**Category:** Self-hosting
**Created:** [2016 年8 月 24 日 19:54 UTC](https://meta.discourse.org/t/access-control-allow-origin-is-there-but-isnt-working/49164 "2016-08-24T19:54:08Z")
**Posts on this page:** 5
**Page:** 1
### 作者：  [@Olivier\_Lambert](https://meta.discourse.org/u/Olivier_Lambert)
#### 发布日期： [2016 年8 月 24 日 19:54 UTC](https://meta.discourse.org/t/access-control-allow-origin-is-there-but-isnt-working/49164/1 "2016-08-24T19:54:08Z")
Hey, I’ve submited my post too soon. Here’s the full post
* * *
Hey guys!
I’m working on a discourse project where I have a discourse install alongside a wordpress install.
So I’ve got “[forum.latranchee.com](http://forum.latranchee.com)” and “[www.latranchee.com](http://www.latranchee.com)”.
Everything works fine.
However, I’d like to have the same top nav on both sites. That way, users could see their notifications whilst reading a blog post per say.
So I’m trying to load the top nav through an ajax load() request. However, I get this error:
```plaintext
XMLHttpRequest cannot load https://forum.latranchee.com/.
No 'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'https://www.olivierlambert.ca' is therefore not allowed access.
The response had HTTP status code 403.
```
I’ve added this in my nginx server block:
```plaintext
add_header 'Access-Control-Allow-Origin' https://www.latranchee.com;
add_header 'X-Frame-Options' https://www.latranchee.com;
```
And I’ve changed my app.yml file as to include this:
```plaintext
DISCOURSE_ENABLE_CORS: true
DISCOURSE_CORS_ORIGIN: '*'
```
Here is the complete server block from my nginx.config:
```plaintext
server {
listen 80; listen [::]:80;
listen 443 ssl;
server_name forum.latranchee.com;
add_header 'Access-Control-Allow-Origin' https://www.latranchee.com;
add_header 'X-Frame-Options' https://www.latranchee.com;
ssl_certificate /etc/nginx/ssl/ssl.crt;
ssl_certificate_key /etc/nginx/ssl/ssl.key;
if ($scheme = http) {
return 301 https://$server_name$request_uri;
}
location / {
proxy_pass http://unix:/var/discourse/shared/standalone/nginx.http.sock:;
proxy_set_header Host $http_host;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
```
Any tips would be greatly appreciated!
---
### 作者：  [@Falco](https://meta.discourse.org/u/Falco)
#### 发布日期： [2016 年8 月 24 日 20:26 UTC](https://meta.discourse.org/t/access-control-allow-origin-is-there-but-isnt-working/49164/2 "2016-08-24T20:26:02Z")
XMLHttpRequest cannot load [https://forum.latranchee.com/](https://forum.latranchee.com/). The ‘Access-Control-Allow-Origin’ header contains multiple values ‘\*, [https://www.latranchee.com](https://www.latranchee.com)’, but only one is allowed. Origin ‘[http://www.latranchee.com](http://www.latranchee.com)’ is therefore not allowed access.
* * *
Use only [https://www.latranchee.com](https://www.latranchee.com) instead of \*
---
### 作者：  [@Olivier\_Lambert](https://meta.discourse.org/u/Olivier_Lambert)
#### 发布日期： [2016 年8 月 24 日 22:20 UTC](https://meta.discourse.org/t/access-control-allow-origin-is-there-but-isnt-working/49164/3 "2016-08-24T22:20:58Z")
Hi! Thank you for your support.
I was getting an error because I was trying to pass post data through my .load() ajax call.
---
### 作者：  [@system](https://meta.discourse.org/u/system)
#### 发布日期： [2019 年2 月 27 日 04:08 UTC](https://meta.discourse.org/t/access-control-allow-origin-is-there-but-isnt-working/49164/4 "2019-02-27T04:08:44Z")
---
### 作者：  [@sam](https://meta.discourse.org/u/sam)
#### 发布日期： [2019 年2 月 27 日 04:49 UTC](https://meta.discourse.org/t/access-control-allow-origin-is-there-but-isnt-working/49164/5 "2019-02-27T04:49:22Z")