---
id: fe0d79a1-e09e-403d-825d-16d37a2e96c4
---

# Apache Cross-Origin Resource Sharing (CORS) Errors
---

Cross-Origin Resource Sharing (CORS) is a security feature in web browsers that restricts web pages from making requests to a different domain than the one that served the web page. When a website tries to make a cross-origin request, the browser will block the request by default. The Apache server is commonly used to serve web pages, and sometimes it can be misconfigured, causing CORS errors to occur. These errors can prevent certain web pages or resources from loading correctly, resulting in a poor user experience.

### Parameters
```shell
export APACHE_CONF_DIR="PLACEHOLDER"

export ORIGIN="PLACEHOLDER"

export RESOURCE_URL="PLACEHOLDER"

export APACHE_ERROR_LOG="PLACEHOLDER"

export _VIRTUALHOST="PLACEHOLDER"

export DOMAIN_NAME="PLACEHOLDER"

export PATH_TO_APACHE_CONFIG_FILE="PLACEHOLDER"
```

## Debug

### Check the Apache configuration file for any CORS-related directives
```shell
grep -i -r "Header set Access-Control-Allow-Origin" ${APACHE_CONF_DIR}
```

### Verify that the CORS headers are being set correctly for the requested resource
```shell
curl -H "Origin: ${ORIGIN}" -I ${RESOURCE_URL}
```

### Check the Apache error log for any CORS-related errors or warnings
```shell
tail -f ${APACHE_ERROR_LOG}
```

### Verify that the CORS headers are being sent from the server to the client
```shell
curl -H "Origin: ${ORIGIN}" -I ${RESOURCE_URL} | grep -i "Access-Control-Allow-Origin"
```

### Check the response headers for any other relevant information
```shell
curl -I ${RESOURCE_URL}
```

## Repair

### Add the appropriate Access-Control-Allow-Origin header to the server response to allow cross-origin requests from the specific domains that need to access the server.
```shell


#!/bin/bash



# Set the domain that needs to access the server

DOMAIN=${DOMAIN_NAME}



# Set the path to the Apache configuration file

CONF_FILE=${PATH_TO_APACHE_CONFIG_FILE}



# Add the Access-Control-Allow-Origin header to the configuration file

sed -i "/${_VIRTUALHOST}/i Header set Access-Control-Allow-Origin \"$DOMAIN\"" $CONF_FILE



# Restart Apache to apply the changes

systemctl restart apache2


```

Cross-Origin Resource Sharing (CORS) is a security feature in web browsers that restricts web pages from making requests to a different domain than the one that served the web page. When a website tries to make a cross-origin request, the browser will block the request by default. The Apache server is commonly used to serve web pages, and sometimes it can be misconfigured, causing CORS errors to occur. These errors can prevent certain web pages or resources from loading correctly, resulting in a poor user experience.


This incident type occurs when the size of HTTP request headers or payload exceeds the limits set by Tomcat server. When this happens, the server may reject the request or return an error message, causing disruption to the normal functioning of the web application. This can be caused by a variety of factors, including large file uploads, excessive use of cookies or query parameters, or attacks that intentionally send oversized requests.


Tomcat HTTP Request Headers or Payload Size Exceeds Limits.

A DoS (Denial of Service) attack on a Tomcat server occurs when attackers flood the server with an overwhelming amount of traffic, causing the server to become unresponsive and unable to handle legitimate requests. This attack results in service disruptions, making the server unavailable to users. The goal of the DoS attack is to make the targeted service unavailable to its users, causing inconvenience or financial losses to the organization that operates the server.


DoS Attack on Tomcat Server

This incident type refers to a high number of client-side request errors for a specific service, in this case HAProxy. This can be caused by various reasons such as client timeout, connection termination or read errors from the client. The incident is triggered when the error rate deviates from the predicted value and exceeds a certain threshold. This incident can affect the end-users' experience and requires immediate attention to prevent further issues.


High number of client-side request errors with HAProxy

This incident type refers to frequent mismatches between the virtual hosts configured on an Apache server. This can cause issues with routing traffic to the intended web application or website, resulting in downtime or other problems. It is important to address these mismatches promptly to ensure the proper functioning of the server and any associated applications.


Virtual Host Mismatches on Apache Server.

This incident type refers to an unauthorized access to directories in Apache HTTPD, which is a widely used web server software. It means that someone was able to access files or directories that they were not supposed to, without having proper authorization. This type of incident can potentially lead to sensitive data being exposed or even stolen, and can compromise the security of the server and the applications running on it.


Unauthorized Directory Access in Apache HTTPD.

```shell
export APACHE_CONF_DIR="PLACEHOLDER"

export ORIGIN="PLACEHOLDER"

export RESOURCE_URL="PLACEHOLDER"

export APACHE_ERROR_LOG="PLACEHOLDER"

export _VIRTUALHOST="PLACEHOLDER"

export DOMAIN_NAME="PLACEHOLDER"

export PATH_TO_APACHE_CONFIG_FILE="PLACEHOLDER"
```


### Check the Apache configuration file for any CORS-related directives

```shell
grep -i -r "Header set Access-Control-Allow-Origin" ${APACHE_CONF_DIR}
```

### Verify that the CORS headers are being set correctly for the requested resource

```shell
curl -H "Origin: ${ORIGIN}" -I ${RESOURCE_URL}
```

### Check the Apache error log for any CORS-related errors or warnings

```shell
tail -f ${APACHE_ERROR_LOG}
```

### Verify that the CORS headers are being sent from the server to the client

```shell
curl -H "Origin: ${ORIGIN}" -I ${RESOURCE_URL} | grep -i "Access-Control-Allow-Origin"
```

### Check the response headers for any other relevant information

```shell
curl -I ${RESOURCE_URL}
```


### Add the appropriate Access-Control-Allow-Origin header to the server response to allow cross-origin requests from the specific domains that need to access the server.

```shell


#!/bin/bash



# Set the domain that needs to access the server

DOMAIN=${DOMAIN_NAME}



# Set the path to the Apache configuration file

CONF_FILE=${PATH_TO_APACHE_CONFIG_FILE}



# Add the Access-Control-Allow-Origin header to the configuration file

sed -i "/${_VIRTUALHOST}/i Header set Access-Control-Allow-Origin \"$DOMAIN\"" $CONF_FILE



# Restart Apache to apply the changes

systemctl restart apache2


```


Apache Cross-Origin Resource Sharing (CORS) Errors

Overview

Parameters

Debug

Verify that the CORS headers are being set correctly for the requested resource

Verify that the CORS headers are being sent from the server to the client

Check the response headers for any other relevant information

Repair

Add the appropriate Access-Control-Allow-Origin header to the server response to allow cross-origin requests from the specific domains that need to access the server.

Learn more

Related Runbooks

Tomcat HTTP Request Headers or Payload Size Exceeds Limits.

DoS Attack on Tomcat Server

High number of client-side request errors with HAProxy

Virtual Host Mismatches on Apache Server.

Support