> [!note] Migrated issue > > <!--Drupal.org comment--> > > <!--Migrated from issue #3417570.--> > > Reported by: [seanmorris227](https://www.drupal.org/user/2880577) ### Problem/Motivation I'm running Drupal 7 under php-wasm in the browser, and I've implemented a custom HTTP request function. The issue I'm having is that when a request is made to [https://updates.drupal.org/...](https://updates.drupal.org/release-history/drupal/7.x?site_key=Pkb-JZK8dh2wUE3jKXZ0oRW6haYw90CI-Q_Hma5vfRo&version=7.95&list=block%2Ccolor%2Ccomment%2Ccontextual%2Cdashboard%2Cdblog%2Cfield%2Cfield_sql_storage%2Cfield_ui%2Cfile%2Cfilter%2Chelp%2Cimage%2Clist%2Cmenu%2Cnode%2Cnumber%2Coptions%2Coverlay%2Cpath%2Crdf%2Csearch%2Cshortcut%2Csystem%2Ctaxonomy%2Ctext%2Ctoolbar%2Cupdate%2Cuser%2Cbartik%2Cseven "https://updates.drupal.org/...") URLs, there are no CORS headers on the response, so the request fails. <div> <pre> <span dir="">\\\\\\\\</span> <!--?php\ $conf\['drupal_http_request_function'\] = 'vrzno_http_request';\ \ function vrzno_http_request($url, array $options = array()) {\   $uri = @parse_url($url);\ \   $result = new stdClass();\ \   if ($uri == FALSE) {\     $result-\--> <span dir="">error = 'unable to parse URL';\\\\\\\\     $result-\\\\\\\\\\\\\\\>code = -1001;\\\\\\\\     return $result;\\\\\\\\   }\\\\\\\\ \\\\\\\\   // Merge the default options.\\\\\\\\   $options += array(\\\\\\\\     'headers' =\\\\\\\\\\\\\\\> array(),\\\\\\\\     'method' =\\\\\\\\\\\\\\\> 'GET',\\\\\\\\     'data' =\\\\\\\\\\\\\\\> NULL,\\\\\\\\     'max_redirects' =\\\\\\\\\\\\\\\> 3,\\\\\\\\     'timeout' =\\\\\\\\\\\\\\\> 30.0,\\\\\\\\     'context' =\\\\\\\\\\\\\\\> NULL,\\\\\\\\     'scheme' =\\\\\\\\\\\\\\\> 'http',\\\\\\\\   );\\\\\\\\ \\\\\\\\   // Merge the default headers.\\\\\\\\   $options\\\\\\\\\\\\\\\['headers'\\\\\\\\\\\\\\\] += array(\\\\\\\\     'User-Agent' =\\\\\\\\\\\\\\\> 'Drupal (+http://drupal.org/)',\\\\\\\\   );\\\\\\\\ \\\\\\\\   $request = (new Vrzno)-\\\\\\\\\\\\\\\>fetch($url, (object)\\\\\\\\\\\\\\\[\\\\\\\\     'headers' =\\\\\\\\\\\\\\\> (object) $options\\\\\\\\\\\\\\\['headers'\\\\\\\\\\\\\\\],\\\\\\\\     'method'  =\\\\\\\\\\\\\\\> $options\\\\\\\\\\\\\\\['method'\\\\\\\\\\\\\\\],\\\\\\\\   \\\\\\\\\\\\\\\]);\\\\\\\\ \\\\\\\\   $response = vrzno_await($request);\\\\\\\\   $content  = vrzno_await($response-\\\\\\\\\\\\\\\>text());\\\\\\\\ \\\\\\\\   $result-\\\\\\\\\\\\\\\>data = $content;\\\\\\\\   $result-\\\\\\\\\\\\\\\>code = 200;\\\\\\\\ \\\\\\\\   return $result;\\\\\\\\ }\\\\\\\\ ?\\\\\\\\\\\\\\\></span> </pre> </div>\\\\#### Steps to reproduce 1) Make a request to [https://updates.drupal.org/...](https://updates.drupal.org/release-history/drupal/7.x?site_key=Pkb-JZK8dh2wUE3jKXZ0oRW6haYw90CI-Q_Hma5vfRo&version=7.95&list=block%2Ccolor%2Ccomment%2Ccontextual%2Cdashboard%2Cdblog%2Cfield%2Cfield_sql_storage%2Cfield_ui%2Cfile%2Cfilter%2Chelp%2Cimage%2Clist%2Cmenu%2Cnode%2Cnumber%2Coptions%2Coverlay%2Cpath%2Crdf%2Csearch%2Cshortcut%2Csystem%2Ctaxonomy%2Ctext%2Ctoolbar%2Cupdate%2Cuser%2Cbartik%2Cseven "https://updates.drupal.org/...") or any other URL on that API 2) Observe that there are currently no CORS headers on the response. ### Proposed resolution The resolution would have the following headers to the response: **For `https://updates.drupal.org/*` & `https://packages.drupal.org/*`** ``` Access-Control-Allow-Origin: * Access-Control-Expose-Headers: ETag Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * ``` **For `https://ftp.drupal.org/files/projects/*`** ``` Access-Control-Allow-Origin: * Access-Control-Expose-Headers: ETag, Accept-Ranges, Content-Range, Content-Disposition Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * ``` OPTIONS for all 3 above: ``` Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Access-Control-Max-Age: 86400 Cache-Control: public, max-age=86400 ``` max-age=86400 can be lowered while in QA. **For `https://www.drupal.org/jsonapi/*`** Further evaluation will be needed, as this does accept session cookies. Original request is: ``` Access-Control-Allow-Headers: * Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS ``` ### Remaining tasks Just the headers, please. ### User interface changes None. ### API changes CORS headers to allow any origin to access [https://updates.drupal.org/...](https://updates.drupal.org/release-history/drupal/7.x?site_key=Pkb-JZK8dh2wUE3jKXZ0oRW6haYw90CI-Q_Hma5vfRo&version=7.95&list=block%2Ccolor%2Ccomment%2Ccontextual%2Cdashboard%2Cdblog%2Cfield%2Cfield_sql_storage%2Cfield_ui%2Cfile%2Cfilter%2Chelp%2Cimage%2Clist%2Cmenu%2Cnode%2Cnumber%2Coptions%2Coverlay%2Cpath%2Crdf%2Csearch%2Cshortcut%2Csystem%2Ctaxonomy%2Ctext%2Ctoolbar%2Cupdate%2Cuser%2Cbartik%2Cseven "https://updates.drupal.org/...") URLs. ### Data model changes None.