title: Safari - XMLHttpRequest cannot load X due to access control checks. [Inspector]
body: <h2>The situation:</h2>
  <p>Whenever you visit this URL in <strong>Safari</strong> <a href="https://nvm.samengroen.com/plan/basic/497" rel="nofollow noreferrer">https://nvm.samengroen.com/plan/basic/497</a> and look in the console there are errors regarding <code>XMLHttpRequest</code> and <code>access control checks</code>.</p>
  <p>The strange part is, when I have the Developer Tool open and reload the page it works fine.</p>
  <p>Can someone clarify why it does work with Developer Tools opened. And what may be causing this issue.</p>
  <h2>Information:</h2>
  <p>This project consists of an <code>Angular</code> frontend <em>(nvm.samengroen.com)</em> and an <code>API-Platform</code> <code>Symfony</code> backend <em>(broker-api.samengroen.com)</em>. They both are on the same wildcard SSL certificate, which I've found might be the answer, but logging in and viewing other pages which get data from the API works without any problem.</p>
  <p>We also tried this in the <code>.env</code> file, without any result:</p>
  <pre><code>###&gt; nelmio/cors-bundle ###
  CORS_ALLOW_ORIGIN=^https?://.*?$
  ###&lt; nelmio/cors-bundle ###
  </code></pre>
  <h2>My findings so far:</h2>
  <p><strong>I've been googling around for a solution but can't find a definitive answer.</strong></p>
  <p><a href="https://laracasts.com/discuss/channels/laravel/cors-access-control-allow-origin-issues-on-safari-mobile-and-desktop" rel="nofollow noreferrer">https://laracasts.com/discuss/channels/laravel/cors-access-control-allow-origin-issues-on-safari-mobile-and-desktop</a></p>
  <blockquote>
  <p>google tells me this would probably be because of a combination of</p>
  <ul>
  <li>HTTP/2 capable browsers</li>
  <li>multiple domain certificate (probably a wildcard cert)</li>
  <li>at some point apache wants to renegotiate the TLS which is not supported in the client implementation of http/2</li>
  </ul>
  </blockquote>
  <hr />
  <p><a href="https://stackoverflow.com/questions/43517254/safari-10-1-xmlhttprequest-with-query-parameters-cannot-load-due-to-access-cont?rq=1">Safari 10.1: XMLHttpRequest with query parameters cannot load due to access control checks</a></p>
  <blockquote>
  <p>Your server needs to reply to the OPTIONS http method. Not only to GET/POST/PUT/DELETE. Safari silently requests this hidden in the background. You can discover this with a MITM-attack on the connection</p>
  </blockquote>
  <hr />
  <h1>Edit #1</h1>
  <p>So after digging around in the server log I found the following:</p>
  <pre><code>AH02032: Hostname nvm.samengroen.com provided via SNI and hostname broker-api.samengroen.com provided via HTTP have no compatible SSL setup, referer: https://nvm.samengroen.com/plan/basic/497
  </code></pre>
  <p>Seems like it does have to do with SSL certificate and possibly wildcard.</p>