Access-Control-Allow-Origin is there, but isn't working!

Product Support Self-hosting

AI 生成的摘要

Access-Control-Allow-Origin Issue

Olivier_Lambert is experiencing issues with loading a top nav via an AJAX request from a WordPress site (https://www.latranchee.com) to a Discourse forum (https://forum.latranchee.com). Despite setting Access-Control-Allow-Origin headers in the Nginx server block and enabling CORS in the app.yml file, the request is still being blocked.

Falco points out that the Access-Control-Allow-Origin header contains multiple values (*, https://www.latranchee.com), which is not allowed. He suggests using only https://www.latranchee.com instead of *.

Olivier_Lambert reveals that the issue was due to passing post data through the .load() AJAX call, which caused an error.

1

Hey, I’ve submited my post too soon. Here’s the full post

Hey guys!

I’m working on a discourse project where I have a discourse install alongside a wordpress install.

So I’ve got “forum.latranchee.com” and “www.latranchee.com”.

Everything works fine.

However, I’d like to have the same top nav on both sites. That way, users could see their notifications whilst reading a blog post per say.

So I’m trying to load the top nav through an ajax load() request. However, I get this error:

XMLHttpRequest cannot load https://forum.latranchee.com/.
No 'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'https://www.olivierlambert.ca' is therefore not allowed access.
The response had HTTP status code 403.

I’ve added this in my nginx server block:

add_header 'Access-Control-Allow-Origin' https://www.latranchee.com;
add_header 'X-Frame-Options' https://www.latranchee.com;

And I’ve changed my app.yml file as to include this:

DISCOURSE_ENABLE_CORS: true
DISCOURSE_CORS_ORIGIN: '*'

Here is the complete server block from my nginx.config:

	server {
		listen 80; listen [::]:80;
		listen 443 ssl;
		server_name forum.latranchee.com;

		add_header 'Access-Control-Allow-Origin' https://www.latranchee.com;
		add_header 'X-Frame-Options' https://www.latranchee.com;

		ssl_certificate /etc/nginx/ssl/ssl.crt;
        ssl_certificate_key /etc/nginx/ssl/ssl.key;

        if ($scheme = http) {
        	return 301 https://$server_name$request_uri;
    	}

		location / {
			proxy_pass http://unix:/var/discourse/shared/standalone/nginx.http.sock:;
			proxy_set_header Host $http_host;
			proxy_http_version 1.1;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		}
	}

Any tips would be greatly appreciated!

2

XMLHttpRequest cannot load https://forum.latranchee.com/. The ‘Access-Control-Allow-Origin’ header contains multiple values ‘*, https://www.latranchee.com’, but only one is allowed. Origin ‘http://www.latranchee.com’ is therefore not allowed access.

Use only https://www.latranchee.com instead of *

3

Hi! Thank you for your support.

I was getting an error because I was trying to pass post data through my .load() ajax call.