Question

I’m trying to get CORS working on my trigger.io app:

I’ve got the following setup in my .htaccess

Header set Access-Control-Allow-Headers: "Accept,Origin,Content-Type,X-Requested-With"
Header set Access-Control-Allow-Methods "GET,PUT,POST,DELETE,OPTIONS"
Header set Access-Control-Allow-Credentials: "true"
Header set Access-Control-Allow-Origin "http://localhost:3000,content://io.trigger.forge99d5a0b8621e11e28cc2123139286d0c"

Running the trigger App in the web (localhost:3000) works fine.

But when I deploy it to an (android) device I see the following error in the debug output:

[ERROR] XMLHttpRequest cannot load {link}http://mydevtest.lan/api/auth/currentuser.{/link} Origin content://io.trigger.forge99d5a0b8621e11e28cc2123139286d0c is not allowed by Access-Control-Allow-Origin. -- From line 1 of null

I’m fearing that setting content:// in the Access-Control-Allow-Origin header is not legal.

Answer 1

The Access-Control-Allow-Origin header as you have it is invalid. Valid values are either ‘*’, or a space separated list of origins. One of the following should work:

Header set Access-Control-Allow-Origin "*"

or

Header set Access-Control-Allow-Origin "http://localhost:3000 content://io.trigger.forge99d5a0b8621e11e28cc2123139286d0c"

Note that I’ve never tested the latter form (with multiple origins). While the CORS spec allows it, browsers may not yet support it.

One other thing you could do is read in the value of the Origin header, validate it on your server (i.e. manually check that the value equals either "http://localhost:3000" or "content://io.trigger.forge99d5a0b8621e11e28cc2123139286d0c"), and then echo only that value in the Access-Control-Allow-Origin response header. However this requires a little more work since it introduces some server-side conditional processing.