asp.net - Header not being set for OPTIONS Ajax request -
i have ascx page gettoken.ashx.
public void processrequest (httpcontext context) { context.response.contenttype = "text/plain"; context.response.appendheader("access-control-allow-origin", "*"); context.response.write(token.createtoken()); } when ajax page, returns following headers:
request method:get status code:200 ok access-control-allow-origin:* cache-control:private content-length:36 content-type:text/plain; charset=utf-8 date:tue, 14 apr 2015 17:20:53 gmt server:microsoft-iis/8.5 x-aspnet-version:4.0.30319 x-powered-by:asp.net when page makes ajax request placed in sandboxed iframe, shows error:
xmlhttprequest cannot load https://127.0.0.1:112/handlers/gettoken.ashx. no 'access-control-allow-origin' header present on requested resource. origin 'null' therefore not allowed access. and returns headers:
request method:options status code:200 ok allow:options, trace, get, head, post content-length:0 date:tue, 14 apr 2015 17:30:14 gmt public:options, trace, get, head, post server:microsoft-iis/8.5 x-powered-by:asp.net i cannot seem options request add header. adding allow-same-origin sandbox properties changes request get, not wish grant iframe permissions.
i assume meant write ashx, not ascx. presence of processrequest (httpcontext context) method suggests it's generic handler , not user control.
i've made simple page test with:
<%@ page language="c#" autoeventwireup="true" %> <!doctype html public "-//w3c//dtd xhtml 1.0 transitional//en" "http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head runat="server"> <title></title> <script type="text/javascript" src="scripts/jquery-1.4.1.js"></script> </head> <body> <div id="testcorsdiv"> </div> <script type="text/javascript"> $.ajax({ type: "get", url: "/handler/testcors.ashx", datatype: "text", success: function (thedata) { $("#testcorsdiv").text(thedata); }, error: function (thedata) { alert('error'); } }); </script> <% if(string.isnullorempty(request.querystring["sandboxed"])) { %> <iframe src="http://127.0.0.1:49253/sandboxtest.aspx?sandboxed=true" sandbox="allow-scripts" width="600"> </iframe> <% } %> </body> </html> i load page on http://localhost:49253/sandboxtest.aspx. page makes ajax request http://localhost:49253/handler/testcors.ashx , puts output testcorsdiv div. generates straight get handler (since it's coming same origin) , output gets inserted.
in page sandboxed iframe loads same page using url http://127.0.0.1:49253/sandboxtest.aspx. ?sandboxed=true there prevent iframe recursively loading inner iframe. page loaded in iframe try make ajax request http://127.0.0.1:49253/handler/testcors.ashx , display output in it's own copy of testcorsdiv div.
as long sandboxed iframe has allow-scripts works charm. iframe generates options request looking (from fiddler, tested chrome):
options http://127.0.0.1:49253/handler/testcors.ashx http/1.1 host: 127.0.0.1:49253 connection: keep-alive cache-control: max-age=0 access-control-request-method: origin: null user-agent: mozilla/5.0 (windows nt 6.1; wow64) applewebkit/537.36 (khtml, gecko) chrome/42.0.2311.90 safari/537.36 access-control-request-headers: accept, x-requested-with accept: */* referer: http://127.0.0.1:49253/sandboxtest.aspx?sandboxed=true accept-encoding: gzip, deflate, sdch accept-language: fi-fi,fi;q=0.8,en-us;q=0.6,en;q=0.4 my testcors.ashx handler spits out headers says looks ay-ok , browser follows get , works.
the testcors.ashx this:
public void processrequest(httpcontext context) { context.response.contenttype = "text/plain"; context.response.appendheader("access-control-allow-origin", "*"); context.response.appendheader("access-control-allow-headers", "content-type, x-requested-with, accept"); context.response.appendheader("access-control-allow-methods", "post, options, get"); context.response.write("hello world"); } so testing suggests should possible want. 1 thing though might issue if handler accessible authenticated/authorized users. can see options request has not sent cookie handler. on other hand question says response options request status code:200. suppose 4** if required authentication cookie missing.
wrapping up, don't know what's wrong in case, maybe (?) simple sample page can give clues find issue yourself.
Comments
Post a Comment