How to set-up CORS headers

[Jan van Unnik]

Hello,

I've installed the Pagespeed Module for Apache on my web server. Everything is working fine, except for the fact that CORS headers are dropped when I enable the module. This results to the server being unable to feedback a status code when a customer fills out a form on my website, making the form to keep stuck on 'loading' when a form is submitted. 

The documentation on the module configuration briefly discusses how to add a resource header (https://modpagespeed.com/doc/configuration#add-resource-header). I've tried implementing this through the pagespeed.conf file (/etc/apache2/mods-available/pagespeed.conf), but failed. Could someone help me how to implement this feature? Is it possible to disable the corresponding filter responsible for this in general? Thank you in advance.

Kind regards,

Jan

[Otto van der Schaaf]

AddResourceHeader only applies to the responses for .pagespeed. urls. I am not sure that it is what you need, as it sounds like the problem is related to submitting a form.

Would it be possible to share the url of a page that exhibits the problem? 

Otto

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/3a25e4a9-51f9-4659-b282-037cf4c0f8f7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Jan van Unnik]

Hello Otto,

Thanks for your reply. Of course! You can test it here: http://jan.marketing/contact The form works without the Pagespeed Module enabled, and doesn't when it is. I've re-enabled the Pagespeed Module for testing :)

Kind regards,

Jan

Op maandag 13 maart 2017 14:02:45 UTC+1 schreef Otto van der Schaaf:

AddResourceHeader only applies to the responses for .pagespeed. urls. I am not sure that it is what you need, as it sounds like the problem is related to submitting a form.

Would it be possible to share the url of a page that exhibits the problem? 

Otto

On Mon, Mar 13, 2017 at 1:16 PM Jan van Unnik <j.van...@gmail.com> wrote:

Hello,

I've installed the Pagespeed Module for Apache on my web server. Everything is working fine, except for the fact that CORS headers are dropped when I enable the module. This results to the server being unable to feedback a status code when a customer fills out a form on my website, making the form to keep stuck on 'loading' when a form is submitted. 

The documentation on the module configuration briefly discusses how to add a resource header (https://modpagespeed.com/doc/configuration#add-resource-header). I've tried implementing this through the pagespeed.conf file (/etc/apache2/mods-available/pagespeed.conf), but failed. Could someone help me how to implement this feature? Is it possible to disable the corresponding filter responsible for this in general? Thank you in advance.

Kind regards,

Jan

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-discuss+unsub...@googlegroups.com.

[Otto van der Schaaf]

I had a look, summarizing:

The form is submitted via javascript / XHR.  The response of the receiving end is not served with a Access-Control-Allow-Origin header.

This gets the following error in Chrome:

XMLHttpRequest cannot load http://form-recipient/api/form. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://htmldomain' is therefore not allowed access.

I wonder how mod_pagespeed influences this. Testing with ?PageSpeed=off on the querystring, the same error occurs.

Could you turn mod_pagespeed off in configuration (so the form post succeeds again?) I would like to have a look at the situation where the post succeeds.

Otto

[Jan van Unnik]

Absolutely! I turned the module on again :) For your information: I'm definitely not an expert on this field, but I believe that these requests are served via the REST API and the Tonic framework by Peej. I found a line in a PHP script that tries to submit a 200 status code via the Tonic framework when an e-mail is successfully sent, after submitting a form.

Kind regards,

Jan

Op maandag 13 maart 2017 15:53:07 UTC+1 schreef Otto van der Schaaf:

[Otto van der Schaaf]

So with mod_pagespeed configured to off, the Access-Control headers show up for the script that processes the form post:

Access-Control-Allow-Credentials:true

Access-Control-Allow-Origin:http://htmldomain

Access-Control-Max-Age:86400

So the vhost that processes the form posts is also running mod_pagespeed?

I wonder why these headers are dropped when mod_pagespeed is turned on. 

 

For now, excluding these requests from processing by mod_pagespeed may resolve the problem:

- You could consider turning mod_pagespeed off for the vhost if it only serves a REST API

- Or you can selectively exclude the affected url:

ModPagespeedDisallow http://anonimized/api/form*

Otto

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/3a25e4a9-51f9-4659-b282-037cf4c0f8f7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-di...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/be970173-3821-4a06-9b4c-b50bc838ce47%40googlegroups.com.

[Jan van Unnik]

Thank you very much Otto. That works like a charm! I'm very happy you took the time to help me. This took me hours of trial and error without success.

Kind regards,

Jan

Op maandag 13 maart 2017 16:15:30 UTC+1 schreef Otto van der Schaaf:

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-discuss+unsub...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/mod-pagespeed-discuss/3a25e4a9-51f9-4659-b282-037cf4c0f8f7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "mod-pagespeed-discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to mod-pagespeed-discuss+unsub...@googlegroups.com.