Apache : CORS header 'Access-Control-Allow-Origin' missing

Question

i am calling some svg image in my website from some other using jquery post i get below error in console

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://abc/svgpaths/sample.svg. (Reason: CORS header 'Access-Control-Allow-Origin' missing).

i have below paramter set in my .htaccess file

<IfModule mod_headers.c>
     Header add Access-Control-Allow-Origin "*"
</IfModule>

i also tested a2enmod headers in putty it showed me Module headers already enabled

But when i use Ip instead of domain name

for eg : https://1.2.3.5/svgpaths/sample.svg

i get below error in console net::ERR_INSECURE_RESPONSE

i could not figure out what to do to fix it please guide me with issue.

Js code to call svg from other server

Case 1 with ip (differnt ssl on main and subdomain)

fabric.loadSVGFromURL("https://1.2.3.4/svgpaths/sample.svg", function(objects, options){
            var object = new fabric.util.groupSVGElements(objects, options);
            object.set({
                fill: '#000000',
                selectable:false
            }); 

Error : ERR_INSECURE_RESPONSE

Case 2 When called with differnet subdomain :(subdomain resolves to same ip as above case 1 , i recently pointed subdomain so is there somesetting in confi file that i missed )

fabric.loadSVGFromURL("https://abd.maindomain.com/svgpaths/sample.svg", function(objects, options){
            var object = new fabric.util.groupSVGElements(objects, options);
            object.set({
                fill: '#000000',
                selectable:false
            }); 

Error :Apache : CORS header 'Access-Control-Allow-Origin' missing

Answer 1

Adding this code in /etc/apache2/sites-available/default-ssl.conf fixed it for me.

Header set Access-Control-Allow-Origin "https://example.com"

Answer 2

It's possible you don't have an active SSL certificate. You can test that by going to the actual request URL.

As well including the actual HTTP response can be helpful (can be found in the network tab of chrome's developer tools).

PS. I would've responded with a comment but that's broken on mobile