Enable CORS Support about com_api

[coolbung]

Good find Sushan !

Let's use all the above comments to have a really solid CORS implementation

[coolbung]

Also set the Access-Control-Allow-Headers value should be Authorization, Access-Control-Allow-Origin, Access-Control-Allow-Methods, X-Authorization, X-Compatibility-Mode, Content-Type, Accept

[coolbung]

@thite-amol in the config section create a new tab CORS and move the existing 2 options there. Also add the above as a third option with comma separated list of headers in a textarea.

[sushan05]

@thite-amol - Faced an issue while calling the API if multiple domains (separated by comma) are provided in "Allow Cross Origin Requests" field. The error message is as follows-

XMLHttpRequest cannot load http://staging.xyz.com/index.php?option=com_api&app=external&resource=homepage&format=raw.
The 'Access-Control-Allow-Origin' header contains multiple values 'http://client-xyz.host/, http://yahoo.com, http://google.com', but only one is allowed. Origin 'http://client-xyz.host' is therefore not allowed access.

After some research, found this link that explains how it works - https://stackoverflow.com/questions/1653308/access-control-allow-origin-multiple-origin-domains

[thite-amol]

This feature is implemented in the latest package so closing it from here.