Re: Header set Access-Control-Allow-Origin for web services

[Booth Martin <booth@xxxxxxxxxxxx>]

I believe the following is an accurate report:

 * The i is remote, reached by VPN.  Lets call
   "i.server.com:10000/web/services/Oceans" TheURL. This is a web
   service providing a short list of 5 oceans from QMYLIB/OCEANSP.
 * There is also an HTTP server set up on the TheURL's domain with a
   website using JavaScript.  That JavaScript presents a web page with
   a nicely formatted layout and attempts to retrieve the Oceans data
   from TheURL.  It fails with the CORS failure.
 * Eclipse is installed on my PC and the same JavaScript set-up is
   installed there, pointing at TheURL.  It fails with the CORS failure.

If I point my regular browser at TheURL i immediately get the 5 oceans 
returned to me.  Both JavaScript installations give me the CORS 
failure.  In other words, any regular web browser inside the VPN can 
easily retrieve the data, but a JavaScript server at the same domain is 
blocked???

Thats just ridiculous; therefore, I am misunderstanding something.



On 12/5/2018 12:15 PM, Justin Taylor wrote:
> Sounds like cross-site scripting.  By default, JavaScript (JS) is prevented from calling servers other than the origin server that served the initial page.
>
> Is you JS trying to call a different server?