Why authenticate request returned 403 after successful login? I have front-end with AngularJS and its connected to drupal backend. I am using drupal services module for rest api.
I have an angularjs web app in subdomain [admin.example.com].
My authentication subdomain [account.example.com] developed with drupal 7.
I can login successfully to account.example.com from admin.example.com using http request from angularjs, so I stored newly generated token. But when i try to collect user data from [account.example.com] using previously stored token, i get 403 status. I'm sure my token is correct.
This work well with chrome disable-web-security mode, when i try from regular mode its response me 403. but i did not get any cors error.
Someone please help me, i'm stack on this stage...
My Apache Conf file [account.example.com]:

&lt;VirtualHost *:80&gt;
    ServerName account.example.com
    ServerAlias account.example.com
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/example_account

    &lt;Directory &quot;/var/www/example_account&quot;&gt;
        AllowOverride All
        Require all granted
        Header always set Access-Control-Allow-Origin &quot;*&quot;
        Header always set Access-Control-Allow-Headers &quot;Content-Type, Accept, Authorization, X-CSRF-Token&quot;
        Header always set Access-Control-Allow-Methods &quot;GET,POST&quot;
        Header always set Access-Control-Allow-Credentials true
    &lt;/Directory&gt;

        #RewriteEngine On
        #RewriteCond %{REQUEST_METHOD} OPTIONS
        #RewriteRule ^(.*)$ $1 [R=200,L]

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
&lt;/VirtualHost&gt;


Here is header requests:
Try to be specific with the ACAO header, like
Access-Control-Allow-Origin: admin.example.com

The wildcard is not really appreciated, browsers may treat this as high security risk and block the request.