How to add Access-Control-Allow-Origin to Magento? PHP solution possible?

Question

As a near final step before launching, we have activated SSL/secure pages for checkout etc and are running into the headaches it brings with cross origin requests.

We have an ajax cart function that calls, in essence:

https://shop.domain.com/checkout/cart/add/

from

http://shop.domain.com/category/product.html

Unfortunately, everything I've tried in htaccess doesn't seem to work and I think the host did not allow/enable mod_headers...

So I'm wondering if there's any PHP solution to allow http://shop.domain.com to access https://shop.domain.com

I've tried adding:

<?php header('Access-Control-Allow-Origin: *'); ?>

To the header.php template, but I imagine that didn't work because headers are probably processed by that point?

Answer 1

Check out this answer on stackoverflow on setting the header in your htaccces. This will ensure the header is properly set on every request from your domain:

Try this in the .htaccess of the external root folder :

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
</IfModule>

And if it only concerns .js scripts you should wrap the above code inside this:

<FilesMatch "\.(js)$">
...
</FilesMatch>

Answer 2

i think the Magento way of doing this whould be:

$this->getResponse()->setHeader('Access-Control-Allow-Origin', 'http://www.example.com');

Answer 3

I think you have a misunderstanding of the "Same-Origin-Policy" by JavaScript. You are not allwed (from browser-perspective) to call different "hosts"* from your page. This means there is NO way to do anything on the server side to change this behaviour (at least theoretically).

What you have to do is change the url of your ajax call that way, that you call an https url of you are on a secure page and call a http url in the other case.

I think the easiest way to get the correct ajax call you can just define the url without protocol, then the browser does his job and completes the URL, as defined in one of the RFCs:

var ajaxUrl = '//domain.com';

domain.com should be read from a PHP variable to be changed easily.

The alternative is to ask magento for a secure url if needed:

var searchSuggestUrl = <?php echo json_encode($this->getUrl('suggest',  array('_secure' =>  Mage::app()->getFrontController()->getRequest()->isSecure()))); ?>;

The json_encode call is to get a correct JS string.

*where host means: same protocoll, same domain, same port.

Update: I think I have the misunderstaning on the Same-Origin-Policy. But still: Use the correct links instead of the Access-Control-Allow-Origin: http header. This is a security problem!

Answer 4

The simplest solution I found was within the Magento settings themselves - in Stores > Settings > Configuration > General > Web > Base URLs, set both the "Base URL" and "Base Secure URL" settings to the https:// prefix, purge the cache, and presto - all generated content references the https protocol. Of course, this assumes you actually want all traffic running securely, but that's really becoming more standard these days anyway instead of, say, segmenting cart traffic from static content when SSL processing was so expensive relative to the capabilities of hosting server CPUs.