angular send cookies from http request to php

Question

so this question ask several time but still i could't figure this out. i'm sending http request from angular app to php service. and i need access the cookies i set from the browser. i know that to access cookies from php service i have to set the withCredentials in my http request. but then again wilcard error raised.

here is the http request

$http({
    url : $scope.urlDomain+ "setting/getAll?skip=0&take=10&orderby=asc",
    method :"POST",
    headers : {
        securityToken : "1124"
    },
    withCredentials: true 
})

i had set the headers in my php file

header("Access-Control-Allow-Origin: * ");
header('Access-Control-Allow-Credentials: true');
header("Access-Control-Allow-Methods: PUT,POST, GET, DELETE, OPTIONS");
header("Access-Control-Allow-Headers: origin, x-requested-with, content-type, securityToken");

this is the error

XMLHttpRequest cannot load http://localhost/services/getAll?skip=0&take=10&orderby=asc. Response to preflight request doesn't pass access control check: A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin 'http://localhost' is therefore not allowed access. The credentials mode of an XMLHttpRequest is controlled by the withCredentials attribute

i stuck in this over day and still could't figure this out. thanks guys

Martijn Welker · Accepted Answer · 2016-07-06 08:31:15Z

2

You cant use header("Access-Control-Allow-Origin: * "); when you enable withCredentials, you have to specify a domain like this:

header("Access-Control-Allow-Origin: 127.0.0.1");
header("Access-Control-Allow-Origin: domain2");
header("Access-Control-Allow-Origin: domain3");

edited Jul 6, 2016 at 8:31

answered Jul 6, 2016 at 8:21

Martijn Welker

5,6151 gold badge19 silver badges26 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Sachila Ranawaka Over a year ago

can i use multiple domains

Martijn Welker Over a year ago

@IT13122256RanawakaR.A.S.M You will have to add multiple rules, i've updated my answer

Sachila Ranawaka Over a year ago

thank man. i found a solution to get the host dynamically using this header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}")

Martijn Welker Over a year ago

@IT13122256RanawakaR.A.S.M It's unsafe to accept every host though, I would make a whitelist and check if the origin is on that list, otherwise deny it

Collectives™ on Stack Overflow

angular send cookies from http request to php

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related