<p>Looking further into the problem, I've found that the page tries to do a post request to the other domain. It calls upon the action function in the <code>UsersController.php</code> file (<code>Location: /craft/app/controllers/</code>)</p>

<p>But because the user isn't logged in on the other domain and anonymous access isn't allowed for this action. You get redirected to /login to login on that domain.</p>

<p><a href="https://craftcms.stackexchange.com/a/12268/635">https://craftcms.stackexchange.com/a/12268/635</a></p>

<p>The developers managed to solve this problem? This applies to almost all controllers require session.</p>

CC BY-SA 3.0
2016-05-24T12:39:25.420Z
2016-05-24T13:30:24.463Z
2017-04-13T12:51:00.303Z
Vitaliy  Badalov
<p>I make request from my localhost(gulp server) to example domain in to VerifyPassword controller. When i make request without <code>headers: {'X-Requested-With': 'XMLHttpRequest'}</code>, It comes as expected 400 Bad request</p>

<pre><code>$.ajax({
        url: 'http://example/index.php/actions/users/verifyPassword',
        type: 'POST',
        data: $data,
        xhrFields: {
            withCredentials: true
        },
        success(data, response) {
            console.log(data, response);
        },
        error(data, response) {
            console.log(response, data);
        }
});
</code></pre>

<p>When i make request with <code>headers: {'X-Requested-With': 'XMLHttpRequest'}</code> comes response <code>XMLHttpRequest cannot load http://example/index.php/actions/users/verifyPassword. Response for preflight is invalid (redirect)</code>, and are not sent cookies. Done OPTIONS preflight request without cookies and server comes 302 and redirect to <code>example/login</code>.
How To be?</p>

<hr>

<p><a href="http://www.yiiframework.com/forum/index.php?/topic/4945-yiiapp-request-isajaxrequest/" rel="nofollow">http://www.yiiframework.com/forum/index.php?/topic/4945-yiiapp-request-isajaxrequest/</a></p>

CC BY-SA 3.0
2016-04-21T17:47:41.353Z
Sounds like you need to set some access control headers? http://stackoverflow.com/a/33645878/684
Brad Bell
CC BY-SA 3.0
2016-04-21T21:24:19.770Z
No, it has long been set in htaccess.
Vitaliy  Badalov
CC BY-SA 3.0
2016-04-21T22:44:27.867Z
try setting `crossDomain: true,` as well
Brad Bell
CC BY-SA 3.0
2016-04-21T23:10:42.790Z
No Brad, I tried does not help, the server most likely does not correctly handle a request preflight
Vitaliy  Badalov
CC BY-SA 3.0
2016-04-24T23:10:48.710Z
Does it work if you post to a controller action that allows anonymous access? Pretty sure the issue is that there isn't a valid authenticated session for the domain you're posting to.
Brad Bell
CC BY-SA 3.0
2016-05-23T15:59:29.233Z
In a preflight request not passed session and cookies, and  why then are redirected to login
Vitaliy  Badalov
CC BY-SA 3.0
2016-05-23T22:13:17.423Z
where i can create issue? Why on response headers added `Location: http://example/login`, even though i send session?
Vitaliy  Badalov
CC BY-SA 3.0
2016-05-23T23:13:42.140Z
it can not because of the time difference? The logs all 3 hours earlier than the locale. While I was putting timezone on craft settings. In response the server returns a date for 3 hours early
Vitaliy  Badalov
<ajax><controller>
Crossdomain ajax request to controller with requireAjaxRequest()
# Crossdomain ajax request to controller with requireAjaxRequest()

(Asked by: username_0 on 2016-04-20)

I make request from my localhost(gulp server) to example domain in to VerifyPassword controller. When i make request without headers: {'X-Requested-With': 'XMLHttpRequest'}, It comes as expected 400 Bad request
$.ajax({
        url: 'http://example/index.php/actions/users/verifyPassword',
        type: 'POST',
        data: $data,
        xhrFields: {
            withCredentials: true
        },
        success(data, response) {
            console.log(data, response);
        },
        error(data, response) {
            console.log(response, data);
        }
});

When i make request with headers: {'X-Requested-With': 'XMLHttpRequest'} comes response XMLHttpRequest cannot load http://example/index.php/actions/users/verifyPassword. Response for preflight is invalid (redirect), and are not sent cookies. Done OPTIONS preflight request without cookies and server comes 302 and redirect to example/login.
How To be?

http://www.yiiframework.com/forum/index.php?/topic/4945-yiiapp-request-isajaxrequest/

**Tags:** ajax, controller
> **Comments:**
> **username_1**: Sounds like you need to set some access control headers? http://stackoverflow.com/a/33645878/684  
> **username_0**: No, it has long been set in htaccess.  
> **username_1**: try setting `crossDomain: true,` as well  
> **username_0**: No Brad, I tried does not help, the server most likely does not correctly handle a request preflight  
> **username_1**: Does it work if you post to a controller action that allows anonymous access? Pretty sure the issue is that there isn't a valid authenticated session for the domain you're posting to.  
> **username_0**: In a preflight request not passed session and cookies, and  why then are redirected to login  
> **username_0**: where i can create issue? Why on response headers added `Location: http://example/login`, even though i send session?  
> **username_0**: it can not because of the time difference? The logs all 3 hours earlier than the locale. While I was putting timezone on craft settings. In response the server returns a date for 3 hours early  

---

## 1 answers

### Answer by username_0 on 2016-05-24. Score: 1

Looking further into the problem, I've found that the page tries to do a post request to the other domain. It calls upon the action function in the `UsersController.php` file (`Location: /craft/app/controllers/`)

But because the user isn't logged in on the other domain and anonymous access isn't allowed for this action. You get redirected to /login to login on that domain.

<https://craftcms.stackexchange.com/a/12268/635>

The developers managed to solve this problem? This applies to almost all controllers require session.


---

