JQuery GET to API on the same domain gives CORS error

Question

I am trying to load some data from an API into the same domain. You can find an example at http://bwq.aintno.info/adc_temp . The request starts when the page loads, so if you look at the console, you can see that the request is not working. However, if I go to the link ( http://bwq.aintno.info/ads/api/index.php/specimens ) on my own in the browser or make a GET request with Postman, it will return JSON just fine, This is the contents of my .htaccess file :

Header set Access-Control-Allow-Origin "*" 

Does anyone have an idea how to fix this? Thanks in advance for any help.

Answer 1

From your comment, I know that you are using an ad unit.

The problem with block blocks is that they block by matching rules either by url or by a specific dom structure (for example, class names or id s).

In general, if you have a problem with checking browsers when disabling all extensions. This can (in most cases) be done using privacy mode, as many of the bad extensions are disabled. Or using a profile without installed extensions.

If everything works well, then this is most likely an interfering extension.

In your case, the problem is with the URL:

  http://bwq.aintno.info/ads/api/index.php/specimens ^________^ 

There is a matching rule for this part, for example. EasyList ( .info/ads/ ) - most likely, other lists have similar rules.

So what is common, having something like ads (or similar) with a delimiter before or after, is likely to be blocked.

Not only attackers cause page problems, but also other extensions that can lead to hacking of the page, so you will need to check it again on frequently used extensions that change dom (I know this is not good news).

But you should definitely check your URLs against the filter list, and you might also consider checking your home against it. Or at least avoid URLs or class and id that sound like ads.

One thing that I don’t know right now, but what bothered me a bit right now is that the rule is in the easy list .info/ads/ . It seems to me that a request, for example script?param=.info/ads/ , may also be blocked. Ok, this should be escaped anyway, but I think I need to add some extra tests to my workflow.