访问控制允许起源错误

Question

I make AJAX calls to the same domain as the origin. For example the origin is http://foo.com/folder/index.php and the domain in my AJAX call is going to http://foo.com/folder/finder.php . So my AJAX call looks basicly like this :

var url = "http://foo.com/folder/finder.php?";
request = createRequest();
request.open("GET", url, true);
request.onreadystatechange = confirmCall;
request.send(null);

In this case finder.php gives me a directory list back. request is a global var. The AJAX call itself works perfect.

While having no problem with CORS issues with different browsers on my computer other people getting the typical CORS Access-Control-Allow-Origin forbidden error. Strange in this sense is that they get this error not always.

Please note : I red most of the relevant links to CORS, such as MDM for instance. They all refer to cross domain calls as this is the issue.

But I defenetly not making calls to cross domains. Or do I oversee something? Please, can anyone help me on this issue having the same problem ?

Answer 1

Since this seems to have fixed the problem, I'll write an answer to cover it so you can finish this question.

If your server accepts both http://www.foo.com/folder/index.php and http://foo.com/folder/index.php (which is not uncommon), then you have to be very careful about how you request your Ajax calls because if someone types http://www.foo.com/folder/index.php into the browser bar so that's the URL used for the web page, but then your Ajax requests goes to http://foo.com/folder/finder.php , then the browser will complain that http://foo.com is not the same origin as http://www.foo.com and will refuse to make the Ajax call for cross origin security reasons.

There are a couple of ways to fix this. First off, you can fix it server-side by auto-redirecting http://foo.com to http://www.foo.com so all Ajax requests come from http://www.foo.com and then use that domain in your Ajax URLs.

Or, on the client side, you can make all your URLs be domain relative so they automatically use whichever domain the web page is using. So, instead of requesting your Ajax URL as http://foo.com/folder/finder.php? , you would use /folder/finder.php? . The browser will automatically use the same domain the web page is loaded from and thus no cross-origin issue.