CORS Policy – No Access-Control-Allow-Origin Solution

If you are using an Apache Webserver, you can simple add the following Lines into your .htaccess File:

<IfModule mod_headers.c>
  <FilesMatch "\.(ttf|ttc|otf|eot|woff|woff2|font.css|css|js)$">
    Header set Access-Control-Allow-Origin "*"
  </FilesMatch>
</IfModule>

If you are using NGINX as a default Webserver, add the following Lines into you Configuration File:

location ~* \.(eot|otf|ttf|woff|woff2)$ {
    add_header Access-Control-Allow-Origin *;
}

The lines above should be just fine to solve the CORS Policy Problem. You say with that lines, that you want to share your Files such as CSS, JS, Fonts etc. with everybody. This is not a Bug, nowadays servers are that smart to recognise, if the request come from a Browser or something else, that’s no worry. If you still want to allow just for your Subdomains, you can use following lines instead. With

 <ifmodule mod_headers.c="">
   SetEnvIf Origin "^(.*\.azizozbek\.ch)$" ORIGIN_SUB_DOMAIN=$1
   Header set Access-Control-Allow-Origin "%{ORIGIN_SUB_DOMAIN}e" env=ORIGIN_SUB_DOMAIN
   Header set Access-Control-Allow-Methods: "*"
   Header set Access-Control-Allow-Headers: "Origin, X-Requested-With, Content-Type, Accept, Authorization"
</ifmodule>

Allowing the CORS Policy just for Subdomains with NGINX:

server { 
server_name example.com;
add_header Access-Control-Allow-Origin static.azizozbek.ch; # < this is the needed header    # rest of the configuration
}

With the Lines belows there should be no CORS Policy Problem anymore. You can use following Command in Terminal to check, if everything is allright:

curl -I https://static.fizyoterapi.st/themes/fizyo/fonts/fontawesome-webfont.ttf?v=4.7.0

If you see the following Line in the Display, you did just well 🙂