# Https request and CORS error

**URL:** <https://forum.ionicframework.com/t/https-request-and-cors-error/198378>\
**Category:** Ionic Angular\
**Created:** [October 22, 2020, 9:47pm UTC](https://forum.ionicframework.com/t/https-request-and-cors-error/198378 "2020-10-22T21:47:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![MacJames](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/macjames/32/134586_2.png) [@MacJames](https://forum.ionicframework.com/u/MacJames)\
**Post date:** [October 22, 2020, 9:47pm UTC](https://forum.ionicframework.com/t/https-request-and-cors-error/198378/1 "2020-10-22T21:47:28Z")

</div>

Hi,  
i have try to get an http post request with ionic but i receive this error:

`Access to XMLHttpRequest at 'https://DDD.org/API/1.0/APINews.php' from origin 'http://192.168.1.22:8100' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status`

I have try with POSTMAN and the server respond correctly

 ![Screenshot at Oct 22 23-45-12](https://global.discourse-cdn.com/ionicframework/original/3X/c/c/cc62ac618c4a1412ac8aeee99608253e0324f902.png)

I use this header in my PHP API (altervista):

```auto
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
header("Access-Control-Allow-Origin: http://192.168.1.22:8100");
header("Content-Type: application/json; charset=UTF-8");
header("Access-Control-Allow-Methods: POST");
header("Access-Control-Max-Age: 3600");
header("Access-Control-Allow-Headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With");

```

Thank you all.

---

<div class="post-metadata">

**Author:** ![MacJames](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/macjames/32/134586_2.png) [@MacJames](https://forum.ionicframework.com/u/MacJames)\
**Post date:** [October 26, 2020, 2:46pm UTC](https://forum.ionicframework.com/t/https-request-and-cors-error/198378/2 "2020-10-26T14:46:41Z")

</div>

I solved it in the following way:

as the first call, in case of POST, the browser does a preflight (http “OPTIONS” method) which only checks the server. To authorize, simply return the CORS headers and return the http 200 status:

```auto
<?php

header("Access-Control-Allow-Origin: *");
header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With');
header("Content-Type: application/json;");

/*foreach (getallheaders() as $name => $value) {
    echo "$name: $value\n";
}*/

switch ($_SERVER['REQUEST_METHOD']) {
    case 'OPTIONS': // preflight
        http_response_code(200);
        exit;
        break;
    
    case 'POST':
        $_POST = array_merge($_POST, json_decode(file_get_contents('php://input'),true));
        $token = isset($_POST['token']) ? $_POST['token'] : NULL;
    break;

    case 'GET':
        $token = isset($_GET['token']) ? $_GET['token'] : NULL;
    break;
}

if ($token === null || $token !== 'mytoken') {
    http_response_code(401);
    echo json_encode(['response' => 'unauthorized']);
    exit;
}

http_response_code(200);

echo json_encode(['mydata' => 'something']);
exit;

```