{"action":"created","issue":{"url":"https://api.github.com/repos/directus/api/issues/615","repository_url":"https://api.github.com/repos/directus/api","labels_url":"https://api.github.com/repos/directus/api/issues/615/labels{/name}","comments_url":"https://api.github.com/repos/directus/api/issues/615/comments","events_url":"https://api.github.com/repos/directus/api/issues/615/events","html_url":"https://github.com/directus/api/issues/615","id":385295946,"node_id":"MDU6SXNzdWUzODUyOTU5NDY=","number":615,"title":"CORS OPTIONS 405 error","user":{"login":"DeHekOnline","id":45427613,"node_id":"MDQ6VXNlcjQ1NDI3NjEz","avatar_url":"https://avatars3.githubusercontent.com/u/45427613?v=4","gravatar_id":"","url":"https://api.github.com/users/DeHekOnline","html_url":"https://github.com/DeHekOnline","followers_url":"https://api.github.com/users/DeHekOnline/followers","following_url":"https://api.github.com/users/DeHekOnline/following{/other_user}","gists_url":"https://api.github.com/users/DeHekOnline/gists{/gist_id}","starred_url":"https://api.github.com/users/DeHekOnline/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DeHekOnline/subscriptions","organizations_url":"https://api.github.com/users/DeHekOnline/orgs","repos_url":"https://api.github.com/users/DeHekOnline/repos","events_url":"https://api.github.com/users/DeHekOnline/events{/privacy}","received_events_url":"https://api.github.com/users/DeHekOnline/received_events","type":"User","site_admin":false},"labels":[{"id":838688385,"node_id":"MDU6TGFiZWw4Mzg2ODgzODU=","url":"https://api.github.com/repos/directus/api/labels/bug","name":"bug","color":"c62828","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-11-28T14:34:07Z","updated_at":"2018-12-04T08:49:04Z","closed_at":null,"author_association":"NONE","body":"## Version Info\r\n  - Directus API version (Or commit hash): latest release\r\n  - PHP version: 7.1\r\n  - MySQL version: working fine ;)\r\n  - Web server: Apache\r\n  - OS name and version: CentOS 7 (w/DirectAdmin)\r\n\r\n## Expected Behavior\r\n\r\nTrying to login to api from remote directus app (located on same server, but other subdomain for testing purposes). \r\n\r\n## Actual Behavior\r\n\r\nIn Chrome dev console on Directus App login screen I'm getting;\r\n\r\n1. The /server/ping request does work\r\n2. XHR response: CORS error OPTIONS 405 method not allowed when App tries to connect to http://domain.com/_/auth/sso\r\nThe response from the API doesn't show any Acces-Control headers in the dev console\r\n\r\n3. I've tried to set the headers manually in a .htaccess file in, but then also the /server/ping\r\n request breaks, stating Access-Control-Allowed-Origin is already set.\r\n\r\n4. I've also configured the api.php in /config to include the headers, but _/auth/sso don't seem to care for a bit :)\r\n\r\n![cors_directus](https://user-images.githubusercontent.com/45427613/49158662-fdf61280-f322-11e8-89ae-aed65376760a.PNG)\r\n\r\nCould you guys point me in the right direction?\r\nThanx"},"comment":{"url":"https://api.github.com/repos/directus/api/issues/comments/444019258","html_url":"https://github.com/directus/api/issues/615#issuecomment-444019258","issue_url":"https://api.github.com/repos/directus/api/issues/615","id":444019258,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NDAxOTI1OA==","user":{"login":"DeHekOnline","id":45427613,"node_id":"MDQ6VXNlcjQ1NDI3NjEz","avatar_url":"https://avatars3.githubusercontent.com/u/45427613?v=4","gravatar_id":"","url":"https://api.github.com/users/DeHekOnline","html_url":"https://github.com/DeHekOnline","followers_url":"https://api.github.com/users/DeHekOnline/followers","following_url":"https://api.github.com/users/DeHekOnline/following{/other_user}","gists_url":"https://api.github.com/users/DeHekOnline/gists{/gist_id}","starred_url":"https://api.github.com/users/DeHekOnline/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DeHekOnline/subscriptions","organizations_url":"https://api.github.com/users/DeHekOnline/orgs","repos_url":"https://api.github.com/users/DeHekOnline/repos","events_url":"https://api.github.com/users/DeHekOnline/events{/privacy}","received_events_url":"https://api.github.com/users/DeHekOnline/received_events","type":"User","site_admin":false},"created_at":"2018-12-04T08:49:04Z","updated_at":"2018-12-04T08:49:04Z","author_association":"NONE","body":"Well, it's a bit of mistery, but this is what works;\r\n\r\nAlthough CORS settings from the api in php got ignored, Chrome (in my case) sees the headers when I set the same headers in .htaccess. But now headers are set double and you will get errors telling you so.\r\n\r\nYou can choose to 'overwrite' the header set by php in .htaccess by using \"Header always set Acces-...\", now the correct headers are shown when you inspect the response in Chrome, BUT...... this was the tricky part ... it turns out that although the headers are shown, they still got ignored, resulting still in \"OPTIONS 403 method not allowed\" ...\r\n\r\nMy solutions was to define al headers in the <directory> of corresponding domain in the Virtual Host on apache directly. Note: My server runs CentOS and DirectAdmin, changing some file locations and settings. Make sure to pay attention to this.\r\n\r\nNow headers are seen, but this results in one last error, saying that the OPTIONS request didn't respond with a 200 OK status. Now in your .htaccess add the following lines to adjust this.\r\n\r\nRewriteEngine On\r\nRewriteCond %{REQUEST_METHOD} OPTIONS\r\nRewriteRule ^(.*)$ $1 [R=200,L]\r\n\r\nI don't know if this is an 'accepted' workaround, but it worked in our case.\r\nHope someone with the same server setup can use this information."}}
{"actor":{"display_login":"DeHekOnline"}}