Configure CORS on a PHP page with Basic Athenticate

Question

Configure CORS on a PHP page with Basic Athenticate

Asked 5 years, 3 months ago

Viewed 3,166 times

1

I posted the page php test. in the field: https://www.teste.com/api/teste.php

<?php
    header("Access-Control-Allow-Origin: *");
    header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
    header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past
if (!(isset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) 
    && $_SERVER['PHP_AUTH_USER'] == 'myuser' 
    && $_SERVER['PHP_AUTH_PW'] == 'mypswd')) {

    header('WWW-Authenticate: Basic realm="Restricted area"');
    header('HTTP/1.1 401 Unauthorized');
    $data['result'] = 'HTTP/1.1 401 Unauthorized';
}
else
{
    $data['result'] = 'HTTP/1.1 200 Ok';
}

echo json_encode($data);

?>

And created a page html test. with the call to said API

<html>
    <body>
        <span id="result"></span>
        <a id="btn-post" href="#">POST</a>
    </body>
</html>
<script src="https://code.jquery.com/jquery-3.3.1.min.js"></script>
<script>
function log(varLog) {

        console.log(varLog);

}
$('#btn-post').click(function () {

$.ajax({
    xhrFields: {
        withCredentials: true
    },
            dataType: 'json',
            type: "post", //Método de envio
            url: 'https://www.teste.com/api/teste.php',
            data: {
                teste:'teste'
            },
            headers: {
                'Authorization': 'Basic ' + btoa('myuser:mypswd')
            },
            beforeSend: function (xhr) { //ocorre antes do POST
                log('beforeSend');      
            },
            success: function (result) { //Sucesso no AJAX  
                log('success');         
                log(result);

            }, 
            error: function(XMLHttpRequest, textStatus, errorThrown) { 
                log('error');
                //log(XMLHttpRequest);
                //log(textStatus);
                //log(errorThrown);

            },
            complete: function (jqXHR, textStatus) { //ocorre ao completar o POST
                log('complete');
                //log(jqXHR);
                //log(textStatus);

            }
        }).done(function (data) {
            log('done');
            //log(data);    
        });

});
</script>

See that in the archive php test. I set the header with Access-Control-Allow-Origin and from what I understand, this would allow the call in different domains and even allow if I don’t use the Basic Authenticate, but with basic authentication CORS does not work at all.

1 answer

Browser other questions tagged php ajax json cors

You are not signed in. Login or sign up in order to post.

by Rafael Laurindo • **281** points · Answer 1 · 2019-04-03T19:51:56+00:00

You need to add in the answer, the headers that release the CORS.

Adding the headers in the test.php file, it should look like this:

<?php
    // CORS HEADERS
    header("Access-Control-Allow-Origin: *");
    header("Access-Control-Allow-Headers: X-Requested-With, Content-Type, Origin, Cache-Control, Pragma, Authorization, Accept, Accept-Encoding");

    header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
    header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past

if (!(isset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) 
    && $_SERVER['PHP_AUTH_USER'] == 'myuser' 
    && $_SERVER['PHP_AUTH_PW'] == 'mypswd')) {

    header('WWW-Authenticate: Basic realm="Restricted area"');
    header('HTTP/1.1 401 Unauthorized');

    $data['result'] = 'HTTP/1.1 401 Unauthorized';
} else {
    $data['result'] = 'HTTP/1.1 200 Ok';
}

echo json_encode($data);