# Access-Control-Allow-Origin is there, but isn't working!

**URL:** <https://meta.discourse.org/t/access-control-allow-origin-is-there-but-isnt-working/49164>\
**Category:** Self-hosting\
**Created:** [2016 年 8 月 24 日午後 7:54 UTC](https://meta.discourse.org/t/access-control-allow-origin-is-there-but-isnt-working/49164 "2016-08-24T19:54:08Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Olivier\_Lambert](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/olivier_lambert/32/74807_2.png) [@Olivier\_Lambert](https://meta.discourse.org/u/Olivier_Lambert)\
**Post date:** [2016 年 8 月 24 日午後 7:54 UTC](https://meta.discourse.org/t/access-control-allow-origin-is-there-but-isnt-working/49164/1 "2016-08-24T19:54:08Z")

</div>

Hey, I’ve submited my post too soon. Here’s the full post

* * *

Hey guys!

I’m working on a discourse project where I have a discourse install alongside a wordpress install.

So I’ve got “[forum.latranchee.com](http://forum.latranchee.com)” and “[www.latranchee.com](http://www.latranchee.com)”.

Everything works fine.

However, I’d like to have the same top nav on both sites. That way, users could see their notifications whilst reading a blog post per say.

So I’m trying to load the top nav through an ajax load() request. However, I get this error:

```plaintext
XMLHttpRequest cannot load https://forum.latranchee.com/.
No 'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'https://www.olivierlambert.ca' is therefore not allowed access.
The response had HTTP status code 403.

```

I’ve added this in my nginx server block:

```plaintext
add_header 'Access-Control-Allow-Origin' https://www.latranchee.com;
add_header 'X-Frame-Options' https://www.latranchee.com;

```

And I’ve changed my app.yml file as to include this:

```plaintext
DISCOURSE_ENABLE_CORS: true
DISCOURSE_CORS_ORIGIN: '*'

```

Here is the complete server block from my nginx.config:

```plaintext
	server {
		listen 80; listen [::]:80;
		listen 443 ssl;
		server_name forum.latranchee.com;

		add_header 'Access-Control-Allow-Origin' https://www.latranchee.com;
		add_header 'X-Frame-Options' https://www.latranchee.com;

		ssl_certificate /etc/nginx/ssl/ssl.crt;
        ssl_certificate_key /etc/nginx/ssl/ssl.key;

        if ($scheme = http) {
        	return 301 https://$server_name$request_uri;
    	}

		location / {
			proxy_pass http://unix:/var/discourse/shared/standalone/nginx.http.sock:;
			proxy_set_header Host $http_host;
			proxy_http_version 1.1;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		}
	}

```

Any tips would be greatly appreciated!

---

_[View the full topic](https://meta.discourse.org/t/access-control-allow-origin-is-there-but-isnt-working/49164)._