How to fix AJAX access not allowed error?

Question

CORS

Good evening. I got the following error:

Failed to load https://*domain1*/wp-admin/admin-ajax.php : The 'Access-Control-Allow-Origin' header has a value ' https://*domain2*/ ' that is not equal to the supplied origin. Origin '*domain2*' is therefore not allowed access.

Where *domain1* is the domain for which the request is made, *domain2* is the domain from which the request is made and the domain specified in the server part in Access-Control-Allow-Origin.

I have already read a lot of articles, looking for various solutions, but none of them helped me. Site on Wordpress, as you probably already understood.

In the server part (i.e. admin-ajax.php) I initially tried to add the following line: But in the end I get an error:
@header( 'Access-Control-Allow-Origin: *' );

Failed to load https://*domain1*/wp-admin/admin-ajax.php : The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin ' https://*domain2* ' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

Also this one:

@header( 'Access-Control-Allow-Origin: https://*domain2*' );

and got the error that I indicated at the very beginning

. I know that the point is that HttpRequest does not want to transfer data, due to the fact that domains are changing, for security reasons. Knowledgeable people, please advise how to get around this error or some correct solution related to WP, which I do not know about.

Thanks in advance

Answer 1

Nevertheless, as a result of dancing with a tambourine over the code, I found a solution:

@header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) );
@header( 'Access-Control-Allow-Origin: https://domain.com' ); // Без слеша в конце. Не знаю почему, но это важно
@header( 'Access-Control-Allow-Credentials: true' );

Answer 2

and if the domain is normal to write?

@header( 'Access-Control-Allow-Origin: https://domain2.com' );