Re: Header set Access-Control-Allow-Origin for web services

Is there a place that uses explanations and examples that would be meaningful to an RPG programmer (The Target Audience for the IWS Wizard)?

On 12/6/2018 3:59 AM, Tim Fathers wrote:

If your web server is on a different port than your web service then it will also fail the "same-origin" policy test (see here https://en.wikipedia.org/wiki/Same-origin_policy).

As I mentioned before, IMO you are better not to mess around with CORS but to forward proxy the web app requests from the HTTP server to the web service. In other words, set-up a forward proxy rule in your web server that says

/web/services ---> localhost:10000/web/services/Oceans

...then change your AJAX requests to be relative to the current host e.g. "/web/services/Oceans/get....". Because these requests are to the same origin you won't fall foul of the same origin policy and your web server will make sure the request gets routed to your Oceans application server.

Tim.

Same-origin policy - Wikipedia<https://en.wikipedia.org/wiki/Same-origin_policy>
In computing, the same-origin policy is an important concept in the web application security model.Under the policy, a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin.An origin is defined as a combination of URI scheme, host name, and port number.
en.wikipedia.org






________________________________
From: WEB400 <web400-bounces@xxxxxxxxxxxx> on behalf of Booth Martin <booth@xxxxxxxxxxxx>
Sent: 05 December 2018 19:52
To: Web Enabling the IBM i (AS/400 and iSeries)
Subject: Re: [WEB400] Header set Access-Control-Allow-Origin for web services

I believe the following is an accurate report:

* The i is remote, reached by VPN. Lets call
"i.server.com:10000/web/services/Oceans" TheURL. This is a web
service providing a short list of 5 oceans from QMYLIB/OCEANSP.
* There is also an HTTP server set up on the TheURL's domain with a
website using JavaScript. That JavaScript presents a web page with
a nicely formatted layout and attempts to retrieve the Oceans data
from TheURL. It fails with the CORS failure.
* Eclipse is installed on my PC and the same JavaScript set-up is
installed there, pointing at TheURL. It fails with the CORS failure.

If I point my regular browser at TheURL i immediately get the 5 oceans
returned to me. Both JavaScript installations give me the CORS
failure. In other words, any regular web browser inside the VPN can
easily retrieve the data, but a JavaScript server at the same domain is
blocked???

Thats just ridiculous; therefore, I am misunderstanding something.



On 12/5/2018 12:15 PM, Justin Taylor wrote:

Sounds like cross-site scripting. By default, JavaScript (JS) is prevented from calling servers other than the origin server that served the initial page.

Is you JS trying to call a different server?

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.midrange.com%2Fmailman%2Flistinfo%2Fweb400&amp;data=02%7C01%7C%7C607c45abd0154ba28a3008d65ae2e5e3%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636796327891626741&amp;sdata=XEXfdSL99O5%2BB2tTmKk5y4T%2B%2Fh4xDv%2FNH7H9Tkv5v4k%3D&amp;reserved=0
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Farchive.midrange.com%2Fweb400&amp;data=02%7C01%7C%7C607c45abd0154ba28a3008d65ae2e5e3%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636796327891626741&amp;sdata=BCt%2BWxbWDpCxPRYJdUYAoJqycs9lxvSsWUYpWbzBeQo%3D&amp;reserved=0.