Ajax cross-Domain request PHP

In many station groups, different functions of the system using a separate domain name, the system has a mutual call between the relationship. Using JS's XMLHttpRequest to invoke other domain names indicates that cross-domain permissions are insufficient. Some may think that all belong to the same top-level domain name or domain name exactly how there is a cross-domain problem.

First look at the error
"XMLHttpRequest Cannot load Http://comment.ttlsa.com/api/post?id=1&msg=123123123&code=453423&username = Cheng Origin http://www.ttlsa.com is isn't allowed by Access-control-allow-origin. "

What is Access-control-allow-origin
Access-control-allow-origin is a server-side return response header defined in HTML5 that addresses cross-domain permissions issues for resources such as fonts.
It defines which domain the resource is allowed to reference, or is referenced by all domains (Google fonts use * means that font resources are allowed to be referenced by all domains).

What are resource cross-domain permissions
Let's take a look at the same field and different domains.
Same domain
http://www.ttlsa.com/
Http://www.ttlsa.com/nginx

different domains
Http://www.ttlsa.com
Http://bbs.ttlsa.com
Https://www.ttlsa.com
http://www.ttlsa.com:8080

Thus, the same domain must be busy with the same protocol, the same port, the same domain name. As long as one of them is not satisfied, it is cross-domain

Cross-Domain case
Site www.ttlsa.com need to call comment.ttlsa.com/api/post.php, then this post.php must add the following code
Code 1

1	Header("access-control-allow-origin:http://www.ttlsa.com");

Code 2
Header mode cannot use regular, such as *.ttlsa.com, but we can use the following method to echo the content into the PHP response content

1	echo ' <meta http-equiv= "Access-control-allow-origin" content= "*.ttlsa.com" > ";

It is not clear why the header is not used in the regular, and meta inside can use regular. Follow-up find the reason, know the brother please leave a message to tell, niche here thanked.

As you can see from the code above, code 1 is not secure enough, but the person using the interface will only get the body content of the response. Code 2 is relatively safe, but the body content of the response contains <meta http-equiv= "Access-control-allow-origin" content= "*.ttlsa.com", how much affects the use of the interface.

Reprinted from: http://www.ttlsa.com/php/xmlhttprequest-cannot-load/

Ajax cross-Domain request PHP