title: CORS Access-Control-Allow-Origin Error on Drupal 7 with Cloudflare
body: <p>We have been having the problem where we get errors of the format.</p>
  
  <blockquote>
    <p>Font from origin '<a href="https://example.com" rel="nofollow">https://example.com</a>' has been blocked from loading by
    Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin'
    header is present on the requested resource. Origin
    '<a href="https://www.example.com" rel="nofollow">https://www.example.com</a>' is therefore not allowed access.</p>
  </blockquote>
  
  <p>We also get a "Redirect at origin" error.</p>
  
  <p>We are using Drupal 7 and Cloudflare.</p>
  
  <p>we have attempted to edit .htaccess to include</p>
  
  <pre><code>Header set Access-Control-Allow-Origin "https://example.com"
  Header set Access-Control-Allow-Origin "https://www.example.com"
  </code></pre>
  
  <p>Tried quite a lot;</p>
  
  <ul>
  <li>have purged cloudflare</li>
  <li>restarted apache</li>
  <li>tried wildcard "*"</li>
  <li>Drupal CORS module</li>
  </ul>
  
  <p>So far no joy.</p>
  
  <p>As this approach is not working, I am wondering if something is being missed or if there is an alternate approach, such as why we are getting origin '<a href="https://example.com" rel="nofollow">https://example.com</a>' being in the request via Drupal and not '<a href="https://www.example.com" rel="nofollow">https://www.example.com</a>'.</p>
  
  <p>Last note it that when I review some resources I see two distinct patterns.
  If a resource has status of "301 Moved Permanently" in the request headers there is </p>
  
  <ul>
  <li>Host www.example.com</li>
  <li>Referer <a href="https://example.com/" rel="nofollow">https://example.com/</a></li>
  </ul>
  
  <p>Where the status is "304 Not Modified" </p>
  
  <ul>
  <li>Host example.com</li>
  <li>Referer <a href="https://example.com/" rel="nofollow">https://example.com/</a></li>
  </ul>
  
  <p>It's odd that there is any www at all; htaccess should be redirecting and it is absent from base_url.</p>