ExpressionEngine and CORS?

Question

I need to enable cross-domain AJAX requests on my site, while limiting the cross-domain access to a particular template.

This template is in its own template group, so the requests from the script would look something like this:

domain.com/embeddable-content

I have this in my .htaccess file:

<IfModule mod_headers.c>
Header set Access-Control-Allow-Origin "*"
</IfModule>

But this grants access across the entire domain. How would I go about restricting access to the single template?

I've googled around, but this is slightly out of my bailiwick, and I figure there my be complications because of EE's file structure (or lack thereof).

Answer 1

If you're only allowing access to a single template, I'd imagine the easiest way would be to use PHP's header to add

header('Access-Control-Allow-Origin: *');

At the top of the template

Answer 2

You should be able to do this in htaccess:

<IfModule mod_headers.c>
  SetEnvIf Request_URI "^/index.php/embeddable-content(/.*)?" CORS=TRUE
  Header set Access-Control-Allow-Origin "*" env=CORS
</IfModule>

This'll only set the CORS header when your request matches that URI.

Answer 3

If you don't want to enable PHP in your templates you can also use https://github.com/nathanpitman/np_access_control_allow_origin.pi.ee_addon to do this. :)