I make request from my localhost(gulp server) to example domain in to VerifyPassword controller. When i make request without headers: {'X-Requested-With': 'XMLHttpRequest'}, It comes as expected 400 Bad request

        url: 'http://example/index.php/actions/users/verifyPassword',
        type: 'POST',
        data: $data,
        xhrFields: {
            withCredentials: true
        success(data, response) {
            console.log(data, response);
        error(data, response) {
            console.log(response, data);

When i make request with headers: {'X-Requested-With': 'XMLHttpRequest'} comes response XMLHttpRequest cannot load http://example/index.php/actions/users/verifyPassword. Response for preflight is invalid (redirect), and are not sent cookies. Done OPTIONS preflight request without cookies and server comes 302 and redirect to example/login. How To be?


  • Sounds like you need to set some access control headers? stackoverflow.com/a/33645878/684 – Brad Bell Apr 21 '16 at 17:47
  • No, it has long been set in htaccess. – Vitaliy Badalov Apr 21 '16 at 21:24
  • 1
    try setting crossDomain: true, as well – Brad Bell Apr 21 '16 at 22:44
  • No Brad, I tried does not help, the server most likely does not correctly handle a request preflight – Vitaliy Badalov Apr 21 '16 at 23:10
  • 1
    Does it work if you post to a controller action that allows anonymous access? Pretty sure the issue is that there isn't a valid authenticated session for the domain you're posting to. – Brad Bell Apr 24 '16 at 23:10

Looking further into the problem, I've found that the page tries to do a post request to the other domain. It calls upon the action function in the UsersController.php file (Location: /craft/app/controllers/)

But because the user isn't logged in on the other domain and anonymous access isn't allowed for this action. You get redirected to /login to login on that domain.


The developers managed to solve this problem? This applies to almost all controllers require session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.