Search code examples
resthttpcross-domaincors

Do I need to enable CORS when my API is on a subdomain of my main website?

I have a RESTful api sitting at a subdomain of my website, so it is setup like below:

api.blah.com - RESTful api
blah.com - Website

When I try to do HTTP requests though, I get the following error:

No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '(index)' is therefore not allowed access.

I thought that because it was on the same domain, this should work, do I need to enable CORS or is there something else I need to do?

The API is built on ASP.Net Web API, and website is AngularJS based.

Thanks

Solution

  • Yes you have to enable it. You have to send CORS allow headers from server side to your browser. This is because a subdomain is a different origin. You probably have to allow HTTP methods like PUT, DELETE, OPTIONS as well. At least I guess angular sends that kind of requests too. You have to handle preflight requests (OPTIONS) by these new methods.