As a near final step before launching, we have activated SSL/secure pages for checkout etc and are running into the headaches it brings with cross origin requests.

We have an ajax cart function that calls, in essence:




Unfortunately, everything I've tried in htaccess doesn't seem to work and I think the host did not allow/enable mod_headers...

So I'm wondering if there's any PHP solution to allow http://shop.domain.com to access https://shop.domain.com

I've tried adding:

<?php header('Access-Control-Allow-Origin: *'); ?>

To the header.php template, but I imagine that didn't work because headers are probably processed by that point?

4 Answers 4


Check out this answer on stackoverflow on setting the header in your htaccces. This will ensure the header is properly set on every request from your domain:

Try this in the .htaccess of the external root folder :

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"

And if it only concerns .js scripts you should wrap the above code inside this:

<FilesMatch "\.(js)$">
  • After adding this Header, my error changed to "Response for preflight has invalid HTTP status code 400"...Any suggestion im trying to connect angular 2 with magento2 as my server?
    – Sushivam
    Commented Apr 16, 2017 at 4:48
  • @SachinS hi, sorry, I dont think I can help you with that. not a frontend hero Commented Apr 17, 2017 at 9:08

i think the Magento way of doing this whould be:

$this->getResponse()->setHeader('Access-Control-Allow-Origin', 'http://www.example.com');
  • 1
    Where do u add this line?
    – Sushivam
    Commented Apr 16, 2017 at 4:29
  • in the appropriate action which renders your template - if you want to add it to all URLs you might use an observer / hook
    – Barbarossa
    Commented Apr 21, 2017 at 12:32

I think you have a misunderstanding of the "Same-Origin-Policy" by JavaScript. You are not allwed (from browser-perspective) to call different "hosts"* from your page. This means there is NO way to do anything on the server side to change this behaviour (at least theoretically).

What you have to do is change the url of your ajax call that way, that you call an https url of you are on a secure page and call a http url in the other case.

I think the easiest way to get the correct ajax call you can just define the url without protocol, then the browser does his job and completes the URL, as defined in one of the RFCs:

var ajaxUrl = '//domain.com';

domain.com should be read from a PHP variable to be changed easily.

The alternative is to ask magento for a secure url if needed:

var searchSuggestUrl = <?php echo json_encode($this->getUrl('suggest',  array('_secure' =>  Mage::app()->getFrontController()->getRequest()->isSecure()))); ?>;

The json_encode call is to get a correct JS string.

*where host means: same protocoll, same domain, same port.

Update: I think I have the misunderstaning on the Same-Origin-Policy. But still: Use the correct links instead of the Access-Control-Allow-Origin: http header. This is a security problem!


The simplest solution I found was within the Magento settings themselves - in Stores > Settings > Configuration > General > Web > Base URLs, set both the "Base URL" and "Base Secure URL" settings to the https:// prefix, purge the cache, and presto - all generated content references the https protocol. Of course, this assumes you actually want all traffic running securely, but that's really becoming more standard these days anyway instead of, say, segmenting cart traffic from static content when SSL processing was so expensive relative to the capabilities of hosting server CPUs.

  • right answer to the wrong question.
    – Paul M
    Commented Aug 26, 2019 at 0:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.