XHR does not work because "Origin is not allowed Access-Control-Allow-Origin"

Question

I am working on an API server with Rails 3, which is still pretty handy, but I run into an error all the time, and I'm not sure if this is due to my Apache installation or Rails application.

When I try to execute an HTTP DELETE or PUT request to http: //sample.domain/uri/id via XHR, curl or HTTP-Client.app Rails or Apache responds with 404 or 403 (depends on the client. I think because of the corsa ), and the Safari Developer Console is responsible

XMLHttpRequest cannot load http://sample.domain/uri/id. Origin http://web.client/ is not allowed by Access-Control-Allow-Origin.

I am using mod_rack aka mod_rails on Apache2, and my vhost really contains this:

Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Methods POST,GET,DELETE,PUT,OPTIONS
Header set Access-Control-Allow-Headers X-Requested-With

Apache error_log error with the following error:

[Sat Oct 30 01:37:34 2010] [error] [client 22.222.222.22] client denied by server configuration: /path/to/rails/folder/public, referer: http://web.client/

Rails development.log responds

Started OPTIONS "/uri/id" for 84.190.123.140 at 2010-10-30 03:18:42 +0200
ActionController::RoutingError (No route matches "/uri/id"):

, OPTIONS , , , OPTIONS, DELETE

, , .

David

Answer 1

OPTIONS. DELETE, , DELETE - . Access-Control-Max-Age.

OPTIONS Access-Control-Allow-Origin ..

, . ACAO , . .

, /, . "*" CORS .

Answer 2

* nix / "" apache

sudo a2enmod

vhost :

Access-Control-Allow-Origin: "*"

Answer 3

.

CORS. - Apache . Apache , " " - Access - .

, , curl -X OPTIONS http://sample.domain/uri/id.