I have a site with http and https. I set in the .htaccess the following line which runs for http.

Header set Access-Control-Allow-Origin "*"

But with https I get this error.

No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://dl.dropboxusercontent.com' is therefore not allowed access.

I tried the following with no luck.

Header set Access-Control-Allow-Origin "*" env=HTTPS

Any way to set Access-Control-Allow-Origin header for https in .htaccess?

Here is my complete .htaccess

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

<IfModule mod_headers.c>
    Header always set Access-Control-Allow-Origin "*"

Here is my virtual host settings

<VirtualHost *:443>

    ServerAdmin admin@localhost
    DocumentRoot /var/www/html/domain

    ServerName domain.com

    SSLEngine on
    SSLProtocol all -SSLv2

    SSLCertificateFile "/etc/pki/tls/private/domain.crt"

    SSLCertificateKeyFile "/etc/pki/tls/private/domain.key"

    SSLCACertificateFile "/etc/pki/tls/private/domain.ca-bundle.crt"

<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

    ErrorLog logs/domain-error_log
    CustomLog logs/domain-access_log common

    <Directory "/var/www/html/domain">
        AllowOverride All


Any solution?


Without the complete .htaccess I don't exactly know but when more processing is done within Apache adding the condition always might be needed:

Header always set Access-Control-Allow-Origin "*" 

The manual explains it as follows:

When your action is a function of an existing header, you may need to specify a condition of always, depending on which internal table the original header was set in.
The table that corresponds to always is used for locally generated error responses as well as successful responses. Note also that repeating this directive with both conditions makes sense in some scenarios because always is not a superset of onsuccess with respect to existing headers:

  • You're adding a header to a locally generated non-success (non-2xx) response, such as a redirect, in which case only the table corresponding to always is used in the ultimate response.

  • You're modifying or removing a header generated by a CGI script, in which case the CGI scripts are in the table corresponding to always and not in the default table.

  • You're modifying or removing a header generated by some piece of the server but that header is not being found by the default onsuccess condition.

  • Thank you, but it is giving me the same response indicating "No 'Access-Control-Allow-Origin' header" – Abdalla Jul 18 '15 at 11:27
  • And changing the order of directives ? – HBruijn Jul 18 '15 at 11:36
  • I am sorry, but I am not sure what do you mean. @HBruijn – Abdalla Jul 18 '15 at 11:41
  • I added virtual host settings and complete .htaccess file. – Abdalla Jul 18 '15 at 11:46
  • Add the Header directive to the top of your configuration, Apache parses directives in order so sometimes the setting one before the other leads to unexpected results. – HBruijn Jul 18 '15 at 11:50

I had to create a .php so that I request the file through request.php?f=main.jpg instead of requesting it directly like domain.com/main.jpg

It's a little ugly work around but it works. Of course I had to add the header Access-Control-Allow-Origin like this. That way I don't need to specify that header in .htaccess file.

 if (isset($_SERVER['HTTP_ORIGIN']) && strpos($_SERVER['HTTP_ORIGIN'],'safedomain') !== false) {
        header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
        header('Access-Control-Allow-Credentials: true');
        header('Access-Control-Max-Age: 86400');    // cache for 1 day

    // Access-Control headers are received during OPTIONS requests

            header("Access-Control-Allow-Methods: GET, POST, OPTIONS");         

            header("Access-Control-Allow-Headers: {$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']}");


Are you using a self signed certificate?


You may encounter difficulties when the request is targeting a HTTPS server using self signed certificates. A possible workaround would be add the certificate in your trusted list. The certificate that comes with the thin webserver will fall under this category.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.