AKSW/OntoWiki — pull request #182 by larseidam (2013-01-21 19:40:21+00:00)
Title: Fix wrong handling of "Access-Control-Allow-Origin"

We notice a problem with History-Feeds Access-Control-Allow-Origin handling. For whatever reason it set Access-Control-Allow-Origin to "*" instead of * (the additional quotes are the problem).

Both firefox and chrome cry because of an AJAX which throwing an error:

```
XML-Verarbeitungsfehler: Kein Element gefunden Adresse: moz-nullprincipal:{0ec9ad4b-6a1f-493e-9cec-6b6b38d56ef6} Zeile Nr. 1, Spalte 1:
```

The request header is:

```
Accept	*/*
Accept-Encoding	gzip, deflate
Accept-Language	de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Host	www.pshb.local
Origin	http://pshbsubway.local
Referer	http://pshbsubway.local/view/?r=http%3A%2F%2Fwww.pshbsubway.local%2Fpubsub%2Fresourcewithfeed
User-Agent	Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0
```

and the response heder is:

```
Access-Control-Allow-Orig...	"*"
Cache-Control	no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection	Keep-Alive
Content-Type	application/atom+xml
Date	Mon, 21 Jan 2013 19:35:02 GMT
Expires	Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive	timeout=5, max=100
Pragma	no-cache
Server	Apache/2.2.22 (Ubuntu)
Set-Cookie	PHPSESSID=ig4momm99emrmn1ndjrcjqlth2; path=/
Transfer-Encoding	chunked
X-Pingback	http://www.pshb.local/pingback/ping/
X-Powered-By	PHP/5.3.10-1ubuntu3.4
```

As you can see in the response header the first line has a invalid value: **"*"**.

After browsing around we found this [forum post](http://arduino.cc/forum/index.php?topic=70685.15) which leads us to [this](https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS?redirectlocale=en-US&redirectslug=HTTP_access_control).

The quintessence is: **fix Access-Control-Allow-Origin**.

**We think there problem is not really the History Feed, its somewhere else where you set the PHP header.**