<p>Ok I realized that this works:</p>
<pre class="lang-php prettyprint-override"><code>$response = Craft::$app-&gt;getResponse();
$response-&gt;headers-&gt;set(&quot;Access-Control-Allow-Origin&quot;, &quot;*&quot;);
</code></pre>
<p>But somehow my axios POST request still has CORS preflight issue, although I can see the headers set in Insomnia...</p>
<p>I have to look for the actual problem now.</p>
<p>=====================
Edit:
Well together with Chat GPT I found out that I kind of need to return the response early for an OPTIONS request. So the CORS preflight gets the headers.</p>
<pre class="lang-php prettyprint-override"><code>$response = Craft::$app-&gt;getResponse();

$response-&gt;headers-&gt;set(&quot;Access-Control-Allow-Origin&quot;, &quot;*&quot;);
$response-&gt;headers-&gt;set(
    &quot;Access-Control-Allow-Methods&quot;,
    &quot;GET, POST, OPTIONS&quot;
);
$response-&gt;headers-&gt;set(&quot;Access-Control-Allow-Headers&quot;, &quot;Content-Type&quot;);
$response-&gt;headers-&gt;set(&quot;Content-Type&quot;, &quot;application/json&quot;);

if (Craft::$app-&gt;getRequest()-&gt;getMethod() === &quot;OPTIONS&quot;) {
    // for CORS preflight we need to return the request early.
    return $response;
}
</code></pre>
<p>I don't fully understand, why I need to do that specifically, but somehow these headers are missing if I don't.
I also can't really imagine that this is not a more commonly met problem... and not documented here already...</p>
<p>Anyway, I hope this helps somebody one day.
Cheers</p>

CC BY-SA 4.0
2023-02-13T19:47:16.770Z
2023-02-13T22:50:13.910Z
2023-02-13T22:50:13.910Z
Merc
<p>I send a POST request from a headless frontend to a craft controller action but the request is not going trough because of:</p>
<blockquote>
<p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at <a href="http://localcraft.ddev.site/add-comment" rel="nofollow noreferrer">http://localcraft.ddev.site/add-comment</a>. (Reason: CORS request did not succeed). Status code: (null).</p>
</blockquote>
<p>(I set a custom route in routes.php, so I can reach the action via <code>/add-comment</code>).</p>
<p>I think I have to do something with <code>$response = Craft::$app-&gt;getResponse();</code>
But I can't figure out what.</p>
<p>I also set this at the beginning of my controller:</p>
<pre><code>class AddToQueueController extends Controller
{
    protected array|bool|int $allowAnonymous = [&quot;add-comment&quot;];
    public $enableCsrfValidation = ![&quot;add-comment&quot;];
</code></pre>
<p>But that does not help either...</p>
<p>I am glad for any help!
Cheers</p>

<modules><controller><headers>
Set "Access-Control-Allow-Origin: *" header in a controller action (CORS issues)
# Set "Access-Control-Allow-Origin: *" header in a controller action (CORS issues)

(Asked by: username_0 on 2023-02-13)

I send a POST request from a headless frontend to a craft controller action but the request is not going trough because of:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localcraft.ddev.site/add-comment. (Reason: CORS request did not succeed). Status code: (null).

(I set a custom route in routes.php, so I can reach the action via /add-comment).
I think I have to do something with $response = Craft::$app->getResponse();
But I can't figure out what.
I also set this at the beginning of my controller:
class AddToQueueController extends Controller
{
    protected array|bool|int $allowAnonymous = ["add-comment"];
    public $enableCsrfValidation = !["add-comment"];

But that does not help either...
I am glad for any help!
Cheers

**Tags:** modules, controller, headers

---

## 1 answers

### Answer by username_0 on 2023-02-13. Score: 2

Ok I realized that this works:
$response = Craft::$app->getResponse();
$response->headers->set("Access-Control-Allow-Origin", "*");

But somehow my axios POST request still has CORS preflight issue, although I can see the headers set in Insomnia...
I have to look for the actual problem now.
=====================
Edit:
Well together with Chat GPT I found out that I kind of need to return the response early for an OPTIONS request. So the CORS preflight gets the headers.
$response = Craft::$app->getResponse();

$response->headers->set("Access-Control-Allow-Origin", "*");
$response->headers->set(
    "Access-Control-Allow-Methods",
    "GET, POST, OPTIONS"
);
$response->headers->set("Access-Control-Allow-Headers", "Content-Type");
$response->headers->set("Content-Type", "application/json");

if (Craft::$app->getRequest()->getMethod() === "OPTIONS") {
    // for CORS preflight we need to return the request early.
    return $response;
}

I don't fully understand, why I need to do that specifically, but somehow these headers are missing if I don't.
I also can't really imagine that this is not a more commonly met problem... and not documented here already...
Anyway, I hope this helps somebody one day.
Cheers


---

