Fixing “No’ Access-Control-Allow-Origin’ Header Present”

‘Access-Control-Allow-Origin‘ is an HTTP header that is used in the context of Cross-Origin Resource Sharing (CORS) to control which origins are allowed to access a resource from a different origin.

When a web browser makes a request for a resource (such as an API endpoint or a web page) from a different origin (domain, protocol, or port), the server hosting that resource includes the ‘Access-Control-Allow-Origin’ header in the response. This header specifies the allowed origins that are permitted to access the resource.

The value of the ‘Access-Control-Allow-Origin’ header can be one of the following:

1. A specific origin: If the header value is set to a specific origin (e.g., ‘https://techstersweb.com‘), it means that only requests originating from that exact origin are allowed to access the resource. Other origins will be blocked by the browser’s security mechanisms.
2. An asterisk (): If the header value is set to ‘‘, it indicates that any origin is allowed to access the resource. This is known as a wildcard value and is less restrictive in terms of security. However, it should be used with caution, as it allows any website to access the resource, potentially exposing sensitive data or resources.

The ‘Access-Control-Allow-Origin’ header is part of the CORS mechanism, which is designed to protect users and ensure that resources are not accessed by unauthorized origins. It helps to prevent cross-site scripting (XSS) attacks and enforce the Same-Origin Policy, which is a security concept that restricts how a document or script loaded from one origin can interact with resources from a different origin.

It’s important to note that the ‘Access-Control-Allow-Origin’ header is sent by the server in the response, not set by the client making the request. The client’s browser interprets this header and determines whether the response can be accessed based on the specified origin(s).’

How to resolve it Access-Control-Allow-Origin ?

Simple, open .htaccess file and add following code

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
</IfModule>

or

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "www.example.com"
</IfModule>