Hi,
This Apache version for your environment can be checked in AMS that is in use for your applications.
Enter either
httpd -v or apachectl -v
Alternatively, you can unblock the pre-flight calls with below approach
(PS: Browsers performs OPTIONS calls to check whether it is safe to send cross origin request to server. Please check all the files before making changes, these are for graphql usage generally used for headless(accessing ContentFragments through persisted graphql) implementations. The paths may change according to your project requirements.)
In your Adobe Experience Manager (AEM) Dispatcher configuration, you can modify your filters.any file and Apache's virtual host configuration. This setup ensures that preflight requests are processed correctly without compromising security.
1. Update filters.any in Dispatcher Configuration
Add the following rule to your filters.any file to allow OPTIONS requests for specific paths, such as GraphQL endpoints
/0060 { /type "allow" /method "(POST|OPTIONS)" /url "/content/_cq_graphql/*/endpoint.json" }
/0061 { /type "allow" /method "(GET|POST|OPTIONS)" /url "/graphql/execute.json*" }
These rules permit OPTIONS requests for the specified GraphQL endpoints, which is essential for CORS preflight checks.
2. Configure Apache Virtual Host for CORS
In your Apache virtual host configuration file (e.g., dispatcher/src/conf.d/available_vhosts/<example>.vhost), add the following CORS headers to handle preflight requests.
<VirtualHost *:80>
...
<IfModule mod_headers.c>
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
Header always set Access-Control-Allow-Headers "Authorization, Content-Type, Accept"
Header always set Access-Control-Max-Age "600"
</IfModule>
...
</VirtualHost>
This configuration allows cross-origin requests from any origin (*), which is suitable for development environments. For production, replace * with specific trusted origins to enhance security.
3. Ensure Authentication Excludes OPTIONS Method
If your server uses Basic Authentication, ensure that OPTIONS requests are excluded from authentication checks. Add the following to your Apache configuration:
<LimitExcept OPTIONS>
Require valid-user
</LimitExcept>
This directive ensures that OPTIONS requests are not blocked by authentication, which is crucial for preflight requests to succeed.
4. Restart Apache Server
After making these changes, restart your Apache server to apply the new configurations:
sudo systemctl restart apache2
By implementing these configurations, your AEM Dispatcher will correctly handle CORS preflight requests, allowing for secure cross-origin interactions, especially for endpoints like GraphQL.
Thanks,
Kind regards,
Kiran Buthpur
