I have set up an API using php, so that other web sites can query a DB on one of my server. When I want to make a test with a client page, I get this:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://www.example.net/my.php?fx=221&ix=603. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
.... .......
Reason: CORS header 'Access-Control-Allow-Origin' missing
I understand, according to this document, that I need to specify who is allowed to use the API.
Adding something like this:
Access-Control-Allow-Origin: https://amazing.site
But what is less clear is where I should add this.
Is it at the apache server level? Or is it in my php page on the server side? Any hint would be appreciated.
In Apache/conf/httpd.conf add code of below:
<IfModule headers_module>
Header set Access-Control-Allow-Origin "https://amazing.site"
</IfModule>
Make sure you have to uncomment of "LoadModule headers_module modules/mod_headers.so" in the same file.
You also can do it in every php file top:
header("Access-Control-Allow-Origin: https://amazing.site");