Vanilla JavaScript CORS request with XDomainRequest in IE8 not working

Question

I try to build a simple wrapper function for making CORS Ajax requests in IE 8:

function getCORS(url, success) {
    var xhr = new XDomainRequest();
    xhr.open('GET', url);
    xhr.onload = success;
    xhr.send();
    return xhr;
}

getCORS('http://foo.com/?q=test', function(request){
    console.log(request.currentTarget.response || request.target.responseText);
});

However, IE 8 returns "Access denied", although CORS requests in modern browsers using 'XMLHttpRequest()' work properly. Any idea?

well IE8 supports XMLHttpRequest so it will always use that. Your check fails. — epascarello, May 15 '15 at 20:54
When using 'var xhr = new XDomainRequest();' directly, IE8 says "Access denied". So, even with a working check, IE 8 still doesn't work here ... — Simon Steinberger, May 15 '15 at 21:06

LordOfThePigs · Accepted Answer · 2015-06-04T08:44:10.433

Internet Explorer's XDomainRequest will never send the Cookies or Authorization headers. This means that if the target of your request is protected, the request can never be authenticated.

If you really have to do this (I had to do this in the past for native HTTP streaming) you need the target of XDomainRequest to be protected using an authorization scheme that doesn't use cookies or the Authorization header (http basic auth). For example, you could obtain some kind of token from a protected address first, and then send that token to your XDomainRequest target.

Vanilla JavaScript CORS request with XDomainRequest in IE8 not working

1 Answers1