Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We built a RESTful server with CORS enabled which means it will be getting OPTIONS requests from the clients. We would like to have the webserver handle these, not our downstream REST-server. How can we configure Apache to handle these request without invoking any external scripts?

In NGINX it is something like this:

   if ($request_method = OPTIONS ) {
        add_header Access-Control-Allow-Origin "*";
        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
        add_header Access-Control-Allow-Headers "ACCEPT, ORIGIN, X-REQUESTED-WITH, CONTENT-TYPE, AUTHORIZATION";
        add_header Access-Control-Allow-Credentials "true";
        add_header Content-Length 0;
        add_header Content-Type text/plain;
        return 200;
   }

But we can't find a similar mechanism in Apache. [edit] The trick is not to set the headers, thats obvious in Apache, but to return '200' from the request without invoking any external script. [/edit]

Need it for our local dev-servers which don't run NGINX. Thanks!

share|improve this question
add comment

1 Answer

For setting those headers in Apache httpd, have a look at the mod_headers. Here is an example (found after some quick googling) that appears to do what you're looking for: http://saulalbert.net/blog/access-control-allow-origin-xmlhttprequest-day-what-fun/

On a side note, since your setup appears to be using NGINX in higher environments, it would be wise to use to NGINX for local dev servers as well, if possible.

share|improve this answer
    
You're absolutely right, but this is for the servers running on our personal Macbooks, for demo and dev purposes. At the moment we generate the header from the REST-server code, but this is even more undesirable then not running NGINX ;) I know how to set headers for Apache, but I can't find anywhere how to have Apache handle the complete request on its own. Then our REST servers need to be aware of OPTIONS requests at all. –  Patrick Savalle Aug 15 '13 at 14:15
    
I looked into the solution you gave, but the part where Apache return without calling any script is missing. The crucial part :) For completeness I would like to mention that for the real requests, you only need the 'Access-Control-Allow-Origin "*";' header, not the others. They are only used by the OPTIONS preflight request. –  Patrick Savalle Aug 15 '13 at 14:17
    
Ah, I see. My understanding is that this should just work. If it doesn't, have a look at your apache confs to see if there are any limits on OPTIONS. Have a look at this discussion for some pointers: stackoverflow.com/questions/13581106/… –  KM. Aug 17 '13 at 14:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.