No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

Heyo!

I’ve ran into this issue after updating the JWT token plugin today. Despite being configured according to the documentation and working just fine all the months before now I’m getting the following CORS error when trying to access any endpoint of the WP REST API.

Access to fetch at 'https://120sek.schuelerwettbewerb.com/wp-json/wp/v2/posts' from origin 'https://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

The actual url has been altered for privacy reasons.

When checking the headers there seems to be a bunch of stuff once I activate the plugin.

Before:

1. access-control-allow-credentials: true
2. access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
3. access-control-allow-methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
4. access-control-allow-origin: https://localhost:3000
5. access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
6. allow: GET
7. content-type: application/json; charset=UTF-8
8. date: Wed, 08 Feb 2023 12:30:35 GMT
9. link: <https://120sek.de/schuelerwettbewerb/wp-json/wp/v2/posts?page=2&gt;; rel=”next”
10. server: Apache
11. vary: Origin
12. x-content-type-options: nosniff
13. x-robots-tag: noindex
14. x-wp-total: 30
15. x-wp-totalpages: 3

After activation:

1. access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
2. access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
3. content-type: application/json; charset=UTF-8
4. date: Wed, 08 Feb 2023 12:27:47 GMT
5. link: <https://120sek.de/schuelerwettbewerb/wp-json/&gt;; rel=”https://api.w.org/&#8221;
6. server: Apache
7. x-content-type-options: nosniff
8. x-robots-tag: noindex
9. Request Headers

This is my current .htaccess config:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]

</IfModule>

All help is greatly appreciated!

• This topic was modified 2 years, 1 month ago by normally.