I am attempting to configure my development environment to allow CORS.
The crux of the problem is when making a cross-domain ajax request with custom headers (
x-requested-with etc) newer browsers will first send an
OPTIONS request checking if the request is in fact allowed. If the correct response headers are set, the original request is subsequently sent and all is merry.
Now, I can successfully set the headers so the second request is sent so no problems there. What I am not sure about is if I
print_r($_SERVER) in the requested PHP script, both dumps are identical (ie, as far as PHP is concerned there were two identical requests made, not one
OPTIONS request then the next (whether that be a
POST or whatever).
Herein lies my issue, if I was to do some action that changed application state (for example) this action would be fired twice since I cannot detect in PHP that the first one was just checking if the CORS headers were set. Typically I would assume that the
$_SERVER['REQUEST_METHOD'] property would contain
OPTIONS for the first request, then
POST for the next one.
Example of the PHP
$_SERVER array (which prints as identical for both requests)
Array ( [HTTP_HOST] => server.host2.tld [HTTP_CONNECTION] => keep-alive [CONTENT_LENGTH] => 0 [HTTP_ORIGIN] => http://client.host1.tld [HTTP_X_REQUESTED_WITH] => XMLHttpRequest [HTTP_USER_AGENT] => Mozilla/5.0 ... [HTTP_ACCEPT] => */* [HTTP_REFERER] => http://client.host1.tld [HTTP_ACCEPT_ENCODING] => gzip,deflate,sdch [HTTP_ACCEPT_LANGUAGE] => en-US,en;q=0.8 [HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.3 [PATH] => /usr/local/bin:/usr/bin:/bin [SERVER_SIGNATURE] => <address>Apache/2.2.16 (Debian) Server</address> [SERVER_SOFTWARE] => Apache/2.2.16 (Debian) [SERVER_NAME] => server.host2.tld [SERVER_ADDR] => <server.ip> [SERVER_PORT] => 80 [REMOTE_ADDR] => <local.ip> [DOCUMENT_ROOT] => /var/www/default [SERVER_ADMIN] => webmaster@localhost [SCRIPT_FILENAME] => /var/www/default/ajax.php [REMOTE_PORT] => 52817 [GATEWAY_INTERFACE] => CGI/1.1 [SERVER_PROTOCOL] => HTTP/1.1 [REQUEST_METHOD] => POST [QUERY_STRING] => [REQUEST_URI] => /ajax.php [SCRIPT_NAME] => /ajax.php [PHP_SELF] => /ajax.php [REQUEST_TIME] => 1342085048 )
And a snippet of the corresponding Apache access log
127.0.0.1 - - [12/Jul/2012:20:53:17 +1200] "OPTIONS /ajax.php HTTP/1.1" 200 1694 127.0.0.1 - - [12/Jul/2012:20:53:17 +1200] "GET /ajax.php HTTP/1.1" 200 1618
To me it seems like Apache isn't telling PHP that its actually an
OPTIONS request. Thus far I have this for setting the
Taken from apache configuration on
server.host2.tld (which appears to be working correctly)
Header always set Access-Control-Allow-Origin "http://client.host1.tld" Header always set Access-Control-Allow-Methods "GET,POST,OPTIONS" Header always set Access-Control-Allow-Headers "origin, x-requested-with"
Am I just being particularly stupid, or is there more to this? I was unsure if this was a SF or a SO question, hopefully this venue is appropriate.