0

My Problem:
The browser does not allow the request to be sent because of the OPTIONS request failure.

The data sent with javascript and it looks like that:

var params = "grant_type=password&username=" + username + "&password=" + password;
        $http({
            url: '/Token',
            method: "POST",
            withCredentials: true,
            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
            data: params
        })


This is how it looks like from the chrome console after the request: enter image description here

Note
When i'm trying to post from fiddler the request is successfully succeed.
But if i'm trying to make an options request from fiddler it fails as the chrome does.

Any ideas?

Dvir
  • 3,287
  • 1
  • 21
  • 33
  • This implies that the remote server is not properly configured to permit the pre-flight `OPTIONS` request. You'll need to edit your IIS configuration to enable `OPTIONS` as an allowed request method. – EricLaw Nov 27 '14 at 03:39

1 Answers1

0

Many providers do not allow this method as it could be used for malicious purposes.

To quote the spec:

This method allows the client to determine the options and/or requirements 
associated with a resource, or the capabilities of a server, without implying
a resource action or initiating a resource retrieval.

I see many hackers probing servers looking for vulnerabilities with this option. I configure all our servers and client servers to return a 405 ERROR (method not allowed).

Community
  • 1
  • 1
john
  • 539
  • 5
  • 13