AJAX请求无效。 错误400和CORS策略解决方案无法正常工作

Question

The task is to validate a specific ID that a new customer is typing into an HTML text input field during registration. The new customer is allowed to register only if 5 numbers are in the input field and the number is given away to an existing member (also a alert box shall pop up).

So this is in my .js file. The following parameter reg_sub is the value of the input from the user.

function checkSubscriberIdValidation( reg_sub )
{   

    if( reg_sub.length == 5)
    {
        console.log(reg_sub);
        jQuery.ajax({
        url: specialStrings.ajax_url,
        type: "GET",
        data: ({action: 'checkCUID', cuID: reg_sub}),
    success: function(result){
            console.log(result);
    },
    error: function(e){
        console.log(e);
    }); 
    }
}

I am trying to call the following code from the file named : checkCUID.php

<?php
if( isset($_GET['cuID']) )
{
    if(!defined("ABSPATH")){
        define( 'ABSPATH', $_SERVER['DOCUMENT_ROOT'].'/');
    }
    try
    {   
        require_once dirname(__FILE__).'/../library.php';
        $service  = Company::getService('CustomerService');
        $response = $service->validateCUID($_GET['cuID']);

        if($response == false)
    {
        return;
        {
        else
        {
            echo '0'; 
        }
    }
    catch(Exception $e)
    {
        echo $e->getMessage();
    }
}
else
{
    echo '0';
}

So the function validateCUID(); is working because I am also testing it with SOAP UI and I get always true back (if I do insert a valid ID).

So this is my response in the Console (a number and a GET 400 ERROR):

99999
GET https://domain.de/wp-admin/admin-ajax.php?action=checkCUID&cuID=99999 400 

I tried to insert into the:

jQuery.ajax({
    contentType: "application/json; charset=utf-8", 
    dataType: "json",
})

but now I got the Error:

Access to XMLHttpRequest at 'https://domain.de/wp-admin/admin-ajax.php?action=checkCUID&cuID=99999' from origin 'http://domain.de' has been blocked by CORS policy: Request header field content-type is not allowed by Access-Control-Allow-Headers in preflight response.

I tried to change the content-type to text/html like its showing in the admin-ajax.php. I saw that the origin domain starts with http and not with https and checked the home and siteurl in the phpMyAdmin and it is https there.

Does anyone know a solution? My guess is: my code is a crap, I am still studying and I am so tired. I am so sorry for that long issue^^!

Answer 1

I noticed that you are using wordpress, try to use this on a plugin or in your template functions.php:

add_filter( 'allowed_http_origins', 'add_allowed_origins' );
function add_allowed_origins( $origins ) {
    $origins[] = 'https://site1.example.com';
    $origins[] = 'https://site2.example.com';
    return $origins;
}

where each url is the frontend URL that are allowed to query the server.