Answers.Body: <p>Ok I realized that this works:</p>
  <pre class="lang-php prettyprint-override"><code>$response = Craft::$app-&gt;getResponse();
  $response-&gt;headers-&gt;set(&quot;Access-Control-Allow-Origin&quot;, &quot;*&quot;);
  </code></pre>
  <p>But somehow my axios POST request still has CORS preflight issue, although I can see the headers set in Insomnia...</p>
  <p>I have to look for the actual problem now.</p>
  <p>=====================
  Edit:
  Well together with Chat GPT I found out that I kind of need to return the response early for an OPTIONS request. So the CORS preflight gets the headers.</p>
  <pre class="lang-php prettyprint-override"><code>$response = Craft::$app-&gt;getResponse();
  
  $response-&gt;headers-&gt;set(&quot;Access-Control-Allow-Origin&quot;, &quot;*&quot;);
  $response-&gt;headers-&gt;set(
      &quot;Access-Control-Allow-Methods&quot;,
      &quot;GET, POST, OPTIONS&quot;
  );
  $response-&gt;headers-&gt;set(&quot;Access-Control-Allow-Headers&quot;, &quot;Content-Type&quot;);
  $response-&gt;headers-&gt;set(&quot;Content-Type&quot;, &quot;application/json&quot;);
  
  if (Craft::$app-&gt;getRequest()-&gt;getMethod() === &quot;OPTIONS&quot;) {
      // for CORS preflight we need to return the request early.
      return $response;
  }
  </code></pre>
  <p>I don't fully understand, why I need to do that specifically, but somehow these headers are missing if I don't.
  I also can't really imagine that this is not a more commonly met problem... and not documented here already...</p>
  <p>Anyway, I hope this helps somebody one day.
  Cheers</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-02-13T19:47:16.770Z
Answers.LastActivityDate: 2023-02-13T22:50:13.910Z
Answers.LastEditDate: 2023-02-13T22:50:13.910Z
Answers.UserDisplayName: Merc
Body: <p>I send a POST request from a headless frontend to a craft controller action but the request is not going trough because of:</p>
  <blockquote>
  <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at <a href="http://localcraft.ddev.site/add-comment" rel="nofollow noreferrer">http://localcraft.ddev.site/add-comment</a>. (Reason: CORS request did not succeed). Status code: (null).</p>
  </blockquote>
  <p>(I set a custom route in routes.php, so I can reach the action via <code>/add-comment</code>).</p>
  <p>I think I have to do something with <code>$response = Craft::$app-&gt;getResponse();</code>
  But I can't figure out what.</p>
  <p>I also set this at the beginning of my controller:</p>
  <pre><code>class AddToQueueController extends Controller
  {
      protected array|bool|int $allowAnonymous = [&quot;add-comment&quot;];
      public $enableCsrfValidation = ![&quot;add-comment&quot;];
  </code></pre>
  <p>But that does not help either...</p>
  <p>I am glad for any help!
  Cheers</p>
  
Tags: <modules><controller><headers>
Title: Set "Access-Control-Allow-Origin: *" header in a controller action (CORS issues)
ThreadText: # Set "Access-Control-Allow-Origin: *" header in a controller action (CORS issues)
  
  (Asked by: username_0 on 2023-02-13)
  
  I send a POST request from a headless frontend to a craft controller action but the request is not going trough because of:
  
  > Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at <http://localcraft.ddev.site/add-comment>. (Reason: CORS request did not succeed). Status code: (null).
  
  (I set a custom route in routes.php, so I can reach the action via `/add-comment`).
  
  I think I have to do something with `$response = Craft::$app->getResponse();`
  But I can't figure out what.
  
  I also set this at the beginning of my controller:
  
  ```
  class AddToQueueController extends Controller
  {
      protected array|bool|int $allowAnonymous = ["add-comment"];
      public $enableCsrfValidation = !["add-comment"];
  
  ```
  
  But that does not help either...
  
  I am glad for any help!
  Cheers
  
  **Tags:** modules, controller, headers
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2023-02-13. Score: 2
  
  Ok I realized that this works:
  
  ```php
  $response = Craft::$app->getResponse();
  $response->headers->set("Access-Control-Allow-Origin", "*");
  
  ```
  
  But somehow my axios POST request still has CORS preflight issue, although I can see the headers set in Insomnia...
  
  I have to look for the actual problem now.
  
  =====================
  Edit:
  Well together with Chat GPT I found out that I kind of need to return the response early for an OPTIONS request. So the CORS preflight gets the headers.
  
  ```php
  $response = Craft::$app->getResponse();
  
  $response->headers->set("Access-Control-Allow-Origin", "*");
  $response->headers->set(
      "Access-Control-Allow-Methods",
      "GET, POST, OPTIONS"
  );
  $response->headers->set("Access-Control-Allow-Headers", "Content-Type");
  $response->headers->set("Content-Type", "application/json");
  
  if (Craft::$app->getRequest()->getMethod() === "OPTIONS") {
      // for CORS preflight we need to return the request early.
      return $response;
  }
  
  ```
  
  I don't fully understand, why I need to do that specifically, but somehow these headers are missing if I don't.
  I also can't really imagine that this is not a more commonly met problem... and not documented here already...
  
  Anyway, I hope this helps somebody one day.
  Cheers
  
  
  ---
  
  