PHP HTTP错误：访问被拒绝及跨域资源加载失败问题咨询

Hey there, let's break down these two common issues and walk through how to fix them step by step:

This error usually means the server is blocking access to your PHP files for one of these reasons—here's how to troubleshoot:

• Check file and directory permissions
  Servers like Apache or Nginx require specific permissions to access PHP files. Make sure:

  • Directories have 755 permissions (read/write/execute for owner, read/execute for others)
  • PHP files have 644 permissions (read/write for owner, read for others)
    You can set these via command line:

  chmod -R 755 /path/to/your/project/directory
  chmod -R 644 /path/to/your/project/*.php
  

  Also, ensure the files/directories are owned by the server's user (e.g., www-data for Apache, nginx for Nginx).

• Inspect your .htaccess file
  A misconfigured .htaccess is a frequent culprit. Look for rules like Deny from all that might target your PHP files. If you find restrictive rules, adjust them—for example, replace Deny from all with Allow from all for the directories you need access to, or refine rewrite rules that might be blocking requests.

• Verify PHP's open_basedir restriction
  The open_basedir setting in php.ini limits which directories PHP can access. If your project files are outside the allowed path, you'll get a 403 error. Open your php.ini file, find the open_basedir line, and add your project directory to the list:

  open_basedir = /var/www/html/:/path/to/your/project/
  

  Don't forget to restart your web server after making changes.

• Check server-level access rules
  For Apache, look at your httpd.conf or site-specific config files. Ensure the <Directory> block for your project allows access:

  <Directory /path/to/your/project>
      AllowOverride All
      Require all granted
  </Directory>
  

  For Nginx, confirm your server block doesn't have deny all rules targeting your PHP files.

This happens because browsers enforce the same-origin policy—your frontend (hosted at http://test.com) is trying to access a backend at https://test.com (different protocol, so it's considered cross-origin). Here's how to fix it:

Fix 1: Add CORS headers directly in your PHP backend #

At the very top of your PHP script (before any output), add these headers to allow the specific origin:

<?php
// Allow requests from your frontend origin
header("Access-Control-Allow-Origin: http://test.com");
// Allow common request methods (include OPTIONS for preflight checks)
header("Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE");
// Allow headers your frontend sends (adjust based on your needs)
header("Access-Control-Allow-Headers: Content-Type, Authorization");

// Handle preflight OPTIONS requests (browsers send these first to check permissions)
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit();
}

// Rest of your PHP code goes here
?>

• Note: In production, avoid using * as the Access-Control-Allow-Origin value (it allows any origin, which is insecure). Always specify the exact frontend domain.

Fix 2: Configure CORS via .htaccess (Apache servers) #

If you don't want to modify every PHP file, add these rules to your project's root .htaccess file:

# Set CORS headers
Header set Access-Control-Allow-Origin "http://test.com"
Header set Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE"
Header set Access-Control-Allow-Headers "Content-Type, Authorization"

# Handle preflight OPTIONS requests
RewriteEngine On
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=200,L]

Fix 3: Configure CORS in Nginx #

If you're using Nginx, add these lines to your site's server block configuration:

# Set CORS headers
add_header Access-Control-Allow-Origin http://test.com;
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
add_header Access-Control-Allow-Headers "Content-Type, Authorization";

# Handle preflight OPTIONS requests
if ($request_method = OPTIONS) {
    return 204;
}

Key Notes for CORS #

• If your frontend sends cookies or authentication tokens, add header("Access-Control-Allow-Credentials: true"); (and don't use * for Access-Control-Allow-Origin).
• Double-check that your server is actually sending these headers—you can use browser dev tools (Network tab) to inspect the response headers from https://test.com.

内容的提问来源于stack exchange，提问作者Hasitha Senanayaka