Yii2 CORS filters allow only specific origin domains fails





.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}







1















I have the following in my behaviors



public function behaviors()

{

    $behaviors = parent::behaviors();

    $auth = $behaviors['authenticator'] = [

        'class' => CompositeAuth::className(),

        'authMethods' => [

            HttpBearerAuth::className(),

            QueryParamAuth::className(),

        ],

        'except' => ['login', 'check-token-validity', 'test-accounts'],

    ];

    unset($behaviors['authenticator']);



    $behaviors['corsFilter'] = [

        'class' => Cors::className(),

        'cors' => [

            // 'Origin' => ['*'],

            'Access-Control-Allow-Credentials' => true,



            'Origin' => static::allowedDomains(),



            'Access-Control-Request-Method' => ['POST', 'PUT'],



            'Access-Control-Expose-Headers' => ['Access_status_code'],

        ],

    ];

    $behaviors['verbs'] = [

        'class' => VerbFilter::className(),

        'actions' => [

            'delete' => ['POST', 'OPTIONS'],

        ],

    ];

    $behaviors['authenticator'] = $auth;

    //access

    return $behaviors;

}





    public static function allowedDomains()

{

    return [

        'http://test1.example.com',

        'http://test2.example.com',

    ];

}


As from the above, I have set origin as the above static domains but when I checked on my ajax request response I found out that the response header origin is set as Access-Control-Allow-Origin: *



Also, I haven't been able to restrict access methods despite setting Access-Control-Request-Method



What else do I need to add for this to work?






php yii2 cors







share|improve this question

























  • Does the response still have Access-Control-Allow-Origin: * if you send a request with Origin: http://not.on.the.white.list/?

    – Quentin
    Jan 3 at 19:04











  • Yes the respose still has Access-Control-Allow-Origin: * even when the origin is not on the whitelisted domain

    – GEOFFREY MWANGI
    Jan 4 at 9:16











  • How do you send ajax?

    – SiZE
    Jan 5 at 14:52


















1















I have the following in my behaviors



public function behaviors()

{

    $behaviors = parent::behaviors();

    $auth = $behaviors['authenticator'] = [

        'class' => CompositeAuth::className(),

        'authMethods' => [

            HttpBearerAuth::className(),

            QueryParamAuth::className(),

        ],

        'except' => ['login', 'check-token-validity', 'test-accounts'],

    ];

    unset($behaviors['authenticator']);



    $behaviors['corsFilter'] = [

        'class' => Cors::className(),

        'cors' => [

            // 'Origin' => ['*'],

            'Access-Control-Allow-Credentials' => true,



            'Origin' => static::allowedDomains(),



            'Access-Control-Request-Method' => ['POST', 'PUT'],



            'Access-Control-Expose-Headers' => ['Access_status_code'],

        ],

    ];

    $behaviors['verbs'] = [

        'class' => VerbFilter::className(),

        'actions' => [

            'delete' => ['POST', 'OPTIONS'],

        ],

    ];

    $behaviors['authenticator'] = $auth;

    //access

    return $behaviors;

}





    public static function allowedDomains()

{

    return [

        'http://test1.example.com',

        'http://test2.example.com',

    ];

}


As from the above, I have set origin as the above static domains but when I checked on my ajax request response I found out that the response header origin is set as Access-Control-Allow-Origin: *



Also, I haven't been able to restrict access methods despite setting Access-Control-Request-Method



What else do I need to add for this to work?






php yii2 cors







share|improve this question

























  • Does the response still have Access-Control-Allow-Origin: * if you send a request with Origin: http://not.on.the.white.list/?

    – Quentin
    Jan 3 at 19:04











  • Yes the respose still has Access-Control-Allow-Origin: * even when the origin is not on the whitelisted domain

    – GEOFFREY MWANGI
    Jan 4 at 9:16











  • How do you send ajax?

    – SiZE
    Jan 5 at 14:52














1












1








1








I have the following in my behaviors



public function behaviors()

{

    $behaviors = parent::behaviors();

    $auth = $behaviors['authenticator'] = [

        'class' => CompositeAuth::className(),

        'authMethods' => [

            HttpBearerAuth::className(),

            QueryParamAuth::className(),

        ],

        'except' => ['login', 'check-token-validity', 'test-accounts'],

    ];

    unset($behaviors['authenticator']);



    $behaviors['corsFilter'] = [

        'class' => Cors::className(),

        'cors' => [

            // 'Origin' => ['*'],

            'Access-Control-Allow-Credentials' => true,



            'Origin' => static::allowedDomains(),



            'Access-Control-Request-Method' => ['POST', 'PUT'],



            'Access-Control-Expose-Headers' => ['Access_status_code'],

        ],

    ];

    $behaviors['verbs'] = [

        'class' => VerbFilter::className(),

        'actions' => [

            'delete' => ['POST', 'OPTIONS'],

        ],

    ];

    $behaviors['authenticator'] = $auth;

    //access

    return $behaviors;

}





    public static function allowedDomains()

{

    return [

        'http://test1.example.com',

        'http://test2.example.com',

    ];

}


As from the above, I have set origin as the above static domains but when I checked on my ajax request response I found out that the response header origin is set as Access-Control-Allow-Origin: *



Also, I haven't been able to restrict access methods despite setting Access-Control-Request-Method



What else do I need to add for this to work?






php yii2 cors







share|improve this question
















I have the following in my behaviors



public function behaviors()

{

    $behaviors = parent::behaviors();

    $auth = $behaviors['authenticator'] = [

        'class' => CompositeAuth::className(),

        'authMethods' => [

            HttpBearerAuth::className(),

            QueryParamAuth::className(),

        ],

        'except' => ['login', 'check-token-validity', 'test-accounts'],

    ];

    unset($behaviors['authenticator']);



    $behaviors['corsFilter'] = [

        'class' => Cors::className(),

        'cors' => [

            // 'Origin' => ['*'],

            'Access-Control-Allow-Credentials' => true,



            'Origin' => static::allowedDomains(),



            'Access-Control-Request-Method' => ['POST', 'PUT'],



            'Access-Control-Expose-Headers' => ['Access_status_code'],

        ],

    ];

    $behaviors['verbs'] = [

        'class' => VerbFilter::className(),

        'actions' => [

            'delete' => ['POST', 'OPTIONS'],

        ],

    ];

    $behaviors['authenticator'] = $auth;

    //access

    return $behaviors;

}





    public static function allowedDomains()

{

    return [

        'http://test1.example.com',

        'http://test2.example.com',

    ];

}


As from the above, I have set origin as the above static domains but when I checked on my ajax request response I found out that the response header origin is set as Access-Control-Allow-Origin: *



Also, I haven't been able to restrict access methods despite setting Access-Control-Request-Method



What else do I need to add for this to work?






php yii2 cors




php yii2 cors






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Jan 3 at 19:00









Muhammad Omer Aslam

13.6k72548




13.6k72548










asked Jan 3 at 2:41









GEOFFREY MWANGIGEOFFREY MWANGI

66953095




66953095













  • Does the response still have Access-Control-Allow-Origin: * if you send a request with Origin: http://not.on.the.white.list/?

    – Quentin
    Jan 3 at 19:04











  • Yes the respose still has Access-Control-Allow-Origin: * even when the origin is not on the whitelisted domain

    – GEOFFREY MWANGI
    Jan 4 at 9:16











  • How do you send ajax?

    – SiZE
    Jan 5 at 14:52



















  • Does the response still have Access-Control-Allow-Origin: * if you send a request with Origin: http://not.on.the.white.list/?

    – Quentin
    Jan 3 at 19:04











  • Yes the respose still has Access-Control-Allow-Origin: * even when the origin is not on the whitelisted domain

    – GEOFFREY MWANGI
    Jan 4 at 9:16











  • How do you send ajax?

    – SiZE
    Jan 5 at 14:52

















Does the response still have Access-Control-Allow-Origin: * if you send a request with Origin: http://not.on.the.white.list/?

– Quentin
Jan 3 at 19:04





Does the response still have Access-Control-Allow-Origin: * if you send a request with Origin: http://not.on.the.white.list/?

– Quentin
Jan 3 at 19:04













Yes the respose still has Access-Control-Allow-Origin: * even when the origin is not on the whitelisted domain

– GEOFFREY MWANGI
Jan 4 at 9:16





Yes the respose still has Access-Control-Allow-Origin: * even when the origin is not on the whitelisted domain

– GEOFFREY MWANGI
Jan 4 at 9:16













How do you send ajax?

– SiZE
Jan 5 at 14:52





How do you send ajax?

– SiZE
Jan 5 at 14:52












0






active

oldest

votes












Your Answer






StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54015663%2fyii2-cors-filters-allow-only-specific-origin-domains-fails%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























0






active

oldest

votes








0






active

oldest

votes









active

oldest

votes






active

oldest

votes
















draft saved

draft discarded




















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54015663%2fyii2-cors-filters-allow-only-specific-origin-domains-fails%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

MongoDB - Not Authorized To Execute Command

Image
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box; } 0 I have successfully enabled authorization on MongoDB and I have created an account on the admin database and then I created an account for my database called test. The following connection string to connect to my test database works successfully: mongo --host 192.168.17.52 --port 27017 -u user1 -p password --authenticationDatabase test Only problem I have now is, I cannot execute commands such as: show dbs. I get the following error when I try to do so: "errmsg" : "not authorized on admin to execute command { listDatabases: 1.0, lsid: { id: UUID("a1d5bc0d-bc58-485e-b232-270758a89455") }, $db: "admin...
Read more

in spring boot 2.1 many test slices are not allowed anymore due to multiple @BootstrapWith

Image
1 I tried to upgrade a yummy sandwich made of two test slices (@JsonTest and @JdbcTest in my case, crunchy test code in between) adding spring boot 2.1 flavour to it. But it seems it was not much of a success. I cannot annotate my tests with many @...Test since they are now each bringing their own XxxTestContextBootstrapper. It used to work when they all used same SpringBootTestContextBootstrapper. @RunWith(SpringRunner.class) @JdbcTest @JsonTest public class Test { @Test public void test() { System.out.printn("Hello, World !"); } } The error I get from BootstrapUtils is illegalStateException : Configuration error: found multiple declarations of @BootstrapWith for test class I understand I might be doing something wrong here but is there an easy way I could load both Json and Jdbc contex...
Read more

How to fix TextFormField cause rebuild widget in Flutter

Image
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box; } 0 I've got the same issue at #9280. I tried all solutions from that topic with/without GlobalKey for Scaffold and Form but the problem wasn't fixed. I tried to build a authentication form with login and signup. But the keyboard doesn't show when I tap the TextFormField at the first time. Then I try to input some letter from physical keyboard, the widget is rebuilt. Like this: login screen Nothing to be log when I run flutter run --verbose, so I logged manually. Every tapping on field, the widget called dispose -> init -> build. [√] Flutter (Channel beta, v1.0.0, on Microsoft Windows [Version 10.0.17763.195], ...
Read more