Support Forums

Support Offline : Mon - Fri / 10am - 6pm (GMT +6)

Your Time: Our Time:

XMLHttpRequest blocked by CORS policy in SP Page Builder

Featured Lock Resolved Issue
Hi chaps - I really hope you can assist me with this because I've been all over the place to try and find a solution.

To cut a long story short, I am trying to embed a number of 3rd party booking calendars into a new site that I'm building.

The calendars work fine when embedded within an article. However, when I add it to SP Page Builder either as RAW HTML code or via a custom module I am getting the following error:

Access to XMLHttpRequest at '' from origin '' has been blocked by CORS policy: Request header field x-csrf-token is not allowed by Access-Control-Allow-Headers in preflight response.

Here is the broken calendar with Page Builder:

Here is the calendar working in an article in Joomla:

The problem is that I need to include the calendars within varying places within Page Builder pages so the article solution isn't going to work for me.

I've added the following to my .htaccess

<FilesMatch "\.(ttf|ttc|otf|eot|woff|woff2|font.css|css|js)$">
Header set Access-Control-Allow-Origin "*"

I've been in touch with the hosts and also the booking calendar developers and they are telling me the preflight request is not a feature of their widget and the xcsrf token is not their token. They also said it looks as if your CMS is adding this to the request as well as appending a query (timestamp) to the end of the Url which again is not something in our making.

In terms of settings:
SP Page Builder Pro 3.4.4
Joomla 3.9.3
PHP 7.2

I really hope you will be able to find a workaround for me? I can happily PM access details to the administator and FTP.


2 Answers


More than a month ago #Permalink
Just a quick follow up from the booking calendar developers.

They said their apache2 vhosts already have Header set Access-Control-Allow-Origin set which accepts from any other domain elsewhere on the web using the verbs GET or POST.

The issue is the preflight being created which contains the options verb which they don't support.

I'm really hoping we can find a workaround for this preflight issue.


More than a month ago #Permalink
Do we have an answer to this issue yet? I have the same problem with a 3rd party form which does not work in any pagebuilder page but works fine on all the other pages of my website. I have the same error as above. Please respond.

There are no replies made for this post yet.
Be one of the first to reply to this post!

Leaderboard (30 days)



Total Accepted Answers: 133
Paul Frankowski

Paul Frankowski

Total Accepted Answers: 92


Total Accepted Answers: 24


Total Accepted Answers: 4
Al Mamun

Al Mamun

Total Accepted Answers: 3




Community Users


Don’t miss any updates of our new templates and extensions and all the astonishing offers we bring for you.
We never spam

Joomla! ® name is used under a limited license from Open Source Matters in the United States and other countries. is not affiliated with or endorsed by Open Source Matters or the Joomla! Project.

Connect Us