I'm being denied access because I'm sending a post through the same origin?

[Acorn Eyes]

 

The origin and the request I'm trying to load are the exact same.

 

I was able to post just fine, I had set a GET and POST request loop every 2.5s.

 

What could cause this issue?

[Acorn Eyes]

Sending a request through the site works just fine and looks exactly like mine.

 

Sending a request through Insomnia works just fine as well.

[Organized]

Add the Access-Control-Allow-Origin Header with appropriate parameters to your webserver. That's XSS protection, you should look it up how it works.

 

Insomnia ignores XSS protection, that's why it works using it and not in your browser.

[burnttoastnice]

If you have access to the webserver, it could be worth adding in the 'Access-Control-Allow-Origin' header for your website.

 

If they're on two different subdomains e.g. an ajax request from a webpage on memes.dankness.website to internal.dankness.website then you need to add memes.dankness.website to the 'Access-Control-Allow-Origin' header sent by internal.dankness.website.

 

Apart from that if they're on the same domain it should work just fine tbh.

[Organized]

13 minutes ago, burnttoastnice said:

Apart from that if they're on the same domain it should work just fine tbh.

I'm pretty sure that Content-Types different from application/x-www-form-urlencoded, multipart/form-data and text/plain need an Access-Control-Allow-Origin value to be set on the webserver, because then it's not a simple request anymore. If no Access-Control-Allow-Origin value is set you can't use application/json.

 

Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

[burnttoastnice]

7 minutes ago, Organized said:

I'm pretty sure that Content-Types different from application/x-www-form-urlencoded, multipart/form-data and text/plain neet an Access-Control-Allow-Origin value to be set on the webserver, because then it's not a simple request anymore. If no Access-Control-Allow-Origin value is set you can't use application/json.

 

Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

I have no problems on my server doing making Ajax requests to a resource on the same domain, e.g. memes.dankness.website/index.html making a get request to memes.dankness.website/session.php. I haven't tried POST requests (done using Ajax) but I don't think those would require the ACAO header on the same domain.

[Acorn Eyes]

4 hours ago, Organized said:

Add the Access-Control-Allow-Origin Header with appropriate parameters to your webserver. That's XSS protection, you should look it up how it works.

 

Insomnia ignores XSS protection, that's why it works using it and not in your browser.

I don't have access to the web server, and the web server has Access-Control-Allow-Origin set to *. At least that's what returned when I made a post request with Insomnia.

 

I'm launching a JavaScript program through the developer console opened on the site in case your confused what I'm doing.

 

Besides, it worked just fine before. All of a sudden it stopped and started giving me this error.