I am developing a site on my main development machine and sometimes I like to code elsewhere away from my desk and on my Chromebook but still on the same network. For other projects, I enable a VirtualHosts plugin to enable access to what I’m working on. The current one I am using is simply called “Virtual Hosts” (https://chrome.google.com/webstore/detail/virtual-hosts/fbkigokjancnolojmhcgcfhgeeljolkh?hl=en). This works fine as projects built with, say, Laravel have relative paths.
The issue I am facing is that when using this method to play around with WordPress, I get a number of CORS warnings in The Dashboard due to the fact that WP provides absolute paths to resources such as AJAX calls. The plugin above rewrites the request entered into the address bar and maps it to an IP address. However, when editing a page, I get errors such as:
Access to fetch at 'http://dev.somedomain.com/wp-
json/wp/v2/pages/2/autosaves?_locale=user' from origin '
http://192.168.0.14' has been blocked by CORS policy: Response to
preflight request doesn't pass access control check: Redirect is not
allowed for a preflight request.
These requests are not being parsed, fail CORS and prevent me from properly interacting with the dashboard. The error above resulted from trying to save a post.
I’ve tried adding Header set Access-Control-Allow-Origin "*"
to my .htaccess resulting in:
Header set Access-Control-Allow-Origin "*"
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
But no change to the errors.
The server is Apache running on Ubuntu 16.04. I have access to my router as well if there is a solution configuring that.
2
Answers
The simplest solution I found was to amend the site address of the Wordpress install to that of the server IP address. Clearly this should only be done for development but it solved my issue.
When CORS is relevant, the browser will send an OPTIONS request(the preflight) before it sends the first POST.
Apache is most likely sending a redirect, but there’s no way to tell if or why unless you check apache’s logs.