jQuery Ajax登录中没有“ Access-Control-Allow-Origin”标头

Question

I have a Login Page called login.php which is in the main first root level and users.php which is in assets/app/users.php . I am using jQuery ajax to do the login process. In the JS part of login.php I have:

    if(loginProceed){
        var data = {email: loginEmail, pass:  loginPass};
        var loginreq = $.ajax({
                                type: "POST",
                                url : "assets/app/users.php",
                                cache: false,
                                data: data
                          });

    loginreq.done(function(html) {
   if(html=='true'){
       window.location.replace('app.php'); }
   else  {
    $("#loginRequest").before('<div class="alert alert-danger err" role="alert">Email or Password Is Not Correct</div>');
    }
    });    
}
     e.preventDefault();
});

and in users.php I have

<?php
header('Access-Control-Allow-Origin: *');
session_start(); 
include 'config.php';
           $email = $_POST['email'];
           $pass  = $_POST['pass'];
           $conn = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_DATABASE);                
           $sql = "SELECT id, email, fname, lname, type FROM users WHERE `email`=? AND `pass`=?";              
           $stmt = $conn->prepare($sql);
           $stmt->bind_param('ss', $email,$pass);
           $stmt->execute();
           $stmt->bind_result($theId,$theEmail,$theFName,$theLname,$theType);
           if ($stmt->fetch()) {
                echo 'true';
                $_SESSION['LOGIN_STATUS'] = true;
                $_SESSION['fname'] = $theFName;
           } else {
                echo 'false';
            }

Now this is doing the Login process for me in all browsers but for some other users it ONLY works on Chrome! or even on none of them and we are getting theses errors in console:

login.js:74 Object login.php:1 XMLHttpRequest cannot load http://domain.ca/login.php . No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin ' http://www.domain.ca ' is therefore not allowed access.

or on FireFox

Password fields present on an insecure (http://) page. This is a security risk that allows user login credentials to be stolen.[Learn More] "SensorNotRequired: https://developers.google.com/maps/documentation/javascript/error-messages " util.js:30:57

and on EI

SCRIPT7002: XMLHttpRequest: Network Error 0x4c7, The operation was canceled by the user.

Can you please let me know why this is happening?

Answer 1

Try to allow single domain

header('Access-Control-Allow-Origin: http://www.domain.ca');

or try modify .htaccess with Header set Access-Control-Allow-Origin "*" enter link description here

Look like your script is loaded from domain.ca ( without www ) but you or other user making request to php from www.domain.ca