I make request from my localhost(gulp server) to example domain in to VerifyPassword controller. When i make request without headers: {'X-Requested-With': 'XMLHttpRequest'}, It comes as expected 400 Bad request

        url: 'http://example/index.php/actions/users/verifyPassword',
        type: 'POST',
        data: $data,
        xhrFields: {
            withCredentials: true
        success(data, response) {
            console.log(data, response);
        error(data, response) {
            console.log(response, data);

When i make request with headers: {'X-Requested-With': 'XMLHttpRequest'} comes response XMLHttpRequest cannot load http://example/index.php/actions/users/verifyPassword. Response for preflight is invalid (redirect), and are not sent cookies. Done OPTIONS preflight request without cookies and server comes 302 and redirect to example/login. How To be?


  • Sounds like you need to set some access control headers? stackoverflow.com/a/33645878/684
    – Brad Bell
    Commented Apr 21, 2016 at 17:47
  • No, it has long been set in htaccess. Commented Apr 21, 2016 at 21:24
  • 1
    try setting crossDomain: true, as well
    – Brad Bell
    Commented Apr 21, 2016 at 22:44
  • No Brad, I tried does not help, the server most likely does not correctly handle a request preflight Commented Apr 21, 2016 at 23:10
  • 1
    Does it work if you post to a controller action that allows anonymous access? Pretty sure the issue is that there isn't a valid authenticated session for the domain you're posting to.
    – Brad Bell
    Commented Apr 24, 2016 at 23:10

1 Answer 1


Looking further into the problem, I've found that the page tries to do a post request to the other domain. It calls upon the action function in the UsersController.php file (Location: /craft/app/controllers/)

But because the user isn't logged in on the other domain and anonymous access isn't allowed for this action. You get redirected to /login to login on that domain.


The developers managed to solve this problem? This applies to almost all controllers require session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.