Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am attempting to configure my development environment to allow CORS.

The crux of the problem is when making a cross-domain ajax request with custom headers (x-requested-with etc) newer browsers will first send an OPTIONS request checking if the request is in fact allowed. If the correct response headers are set, the original request is subsequently sent and all is merry.

Now, I can successfully set the headers so the second request is sent so no problems there. What I am not sure about is if I print_r($_SERVER) in the requested PHP script, both dumps are identical (ie, as far as PHP is concerned there were two identical requests made, not one OPTIONS request then the next (whether that be a GET or POST or whatever).

Herein lies my issue, if I was to do some action that changed application state (for example) this action would be fired twice since I cannot detect in PHP that the first one was just checking if the CORS headers were set. Typically I would assume that the $_SERVER['REQUEST_METHOD'] property would contain OPTIONS for the first request, then GET or POST for the next one.

Example of the PHP $_SERVER array (which prints as identical for both requests)

    [HTTP_HOST] => server.host2.tld
    [HTTP_CONNECTION] => keep-alive
    [HTTP_ORIGIN] => http://client.host1.tld
    [HTTP_USER_AGENT] => Mozilla/5.0 ...
    [HTTP_ACCEPT] => */*
    [HTTP_REFERER] => http://client.host1.tld
    [HTTP_ACCEPT_ENCODING] => gzip,deflate,sdch
    [HTTP_ACCEPT_LANGUAGE] => en-US,en;q=0.8
    [HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.3
    [PATH] => /usr/local/bin:/usr/bin:/bin
    [SERVER_SIGNATURE] => <address>Apache/2.2.16 (Debian) Server</address>
    [SERVER_SOFTWARE] => Apache/2.2.16 (Debian)
    [SERVER_NAME] => server.host2.tld
    [SERVER_ADDR] => <server.ip>
    [SERVER_PORT] => 80
    [REMOTE_ADDR] => <local.ip>
    [DOCUMENT_ROOT] => /var/www/default
    [SERVER_ADMIN] => webmaster@localhost
    [SCRIPT_FILENAME] => /var/www/default/ajax.php
    [REMOTE_PORT] => 52817
    [QUERY_STRING] => 
    [REQUEST_URI] => /ajax.php
    [SCRIPT_NAME] => /ajax.php
    [PHP_SELF] => /ajax.php
    [REQUEST_TIME] => 1342085048

And a snippet of the corresponding Apache access log - - [12/Jul/2012:20:53:17 +1200] "OPTIONS /ajax.php HTTP/1.1" 200 1694 - - [12/Jul/2012:20:53:17 +1200] "GET /ajax.php HTTP/1.1" 200 1618

To me it seems like Apache isn't telling PHP that its actually an OPTIONS request. Thus far I have this for setting the Access-Control-* headers:

Taken from apache configuration on server.host2.tld (which appears to be working correctly)

Header always set Access-Control-Allow-Origin "http://client.host1.tld"
Header always set Access-Control-Allow-Methods "GET,POST,OPTIONS"
Header always set Access-Control-Allow-Headers "origin, x-requested-with"

Am I just being particularly stupid, or is there more to this? I was unsure if this was a SF or a SO question, hopefully this venue is appropriate.


share|improve this question
I'm also aware I could just not set the extra headers to avoid the 'preflight' request, but I would prefer to see if there is a server-side solution. –  phindmarsh Jul 12 '12 at 9:44
can you please tell me where should i specify Access-control options in httpd.conf ? –  Hunt Dec 4 '12 at 13:23
If you are using vhosts then in your <VirtualHost> directive, otherwise just anywhere would work. Just make sure you have mod_headers enabled. –  phindmarsh Dec 5 '12 at 8:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.