I'm trying to set headers if the origin is a particular site to solve a resource conflict I'm having (using Mautic hosted on a subdomain).
If I add the headers for any situation I get a 500 error when I try to use Mautic, but the resource being accessed from my site works, hence I only want to set them when my site is the origin.
This is what I have:
RewriteEngine On
#preserve HTTP(S)
RewriteCond %{HTTPS} =on
RewriteRule ^(.*)$ - [env=proto:https]
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ - [env=proto:http]
<IfModule mod_headers.c>
SetEnvIfNoCase Origin %{ENV:proto}://mysite.com ENV_SET
SetEnvIfNoCase Origin %{ENV:proto}://mautic.mysite.com ENV_SET=0
Header add Access-Control-Allow-Origin %{ENV:proto}://mysite.com env=ENV_SET
Header set Access-Control-Allow-Credentials true env=ENV_SET
Header set Access-Control-Allow-Methods: GET, POST, PATCH, PUT, OPTIONS env=ENV_SET
Header set Access-Control-Allow-Headers: Origin, Content-Type, X-Auth-Token env=ENV_SET
</IfModule>
As far as I understood that would make the headers set conditionally on existence of the environment variable, but they're being set no matter what. If I remove the SetEnvIf lines they're still set. I did find this which suggests that it should be placed in configuration instead of .htaccess, but I'm not sure what that means.
Any suggestions on how I can fix this, or another way to make it work?
Thanks
EDIT: syntax updated with advice from w3dk, now looks like
SetEnvIfNoCase Origin "%{ENV:proto}://mysite.com" ENV_SET
SetEnvIfNoCase Origin "%{ENV:proto}://mautic.mysite.com" !ENV_SET
Header set Access-Control-Allow-Origin "%{ENV:proto}://mysite.com" env=ENV_SET
Header set Access-Control-Allow-Credentials "true" env=ENV_SET
Header set Access-Control-Allow-Methods "GET, POST, PATCH, PUT, OPTIONS" env=ENV_SET
Header set Access-Control-Allow-Headers "Origin, Content-Type, X-Auth-Token" env=ENV_SET
EDIT 2: Turns out it doesn't like the %{ENV:proto} part, so I've changed that to http and added another line for https. The subdomain is working fine and the headers are setting, except that I'm getting 'Credentials flag is 'true', but the 'Access-Control-Allow-Credentials' header is 'true, true'.' in the console. It's only being set once (I also tried 'merge', and I'm using set for the Allow-Origin; I can't figure out where else this would be set.
%{ENV:proto}
server/environment variable is not expanded since that argument is a regex, not an ordinary string. What do you mean by "Credentials flag is 'true'" - what flag is that (or are you referring to theAccess.....Credentials
header)? If you are getting the header valuetrue, true
then that would seem to imply amerge
header somewhere?