当我的API位于主网站的子域中时，是否需要启用CORS？

Question

I have a RESTful api sitting at a subdomain of my website, so it is setup like below:

api.blah.com - RESTful api
blah.com - Website

When I try to do HTTP requests though, I get the following error:

No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '(index)' is therefore not allowed access.

I thought that because it was on the same domain, this should work, do I need to enable CORS or is there something else I need to do?

The API is built on ASP.Net Web API, and website is AngularJS based.

Thanks

Answer 1

Yes you have to enable it. You have to send CORS allow headers from server side to your browser. This is because a subdomain counts as a different origin . You probably have to allow HTTP methods like PUT, DELETE, OPTIONS as well. At least I guess angular sends that kind of requests too. You have to handle preflight requests (OPTIONS) by these new methods.