WCF Web API RESTful is not allowed by Access-Control-Allow-Origin

Question

Seems like I have a cross domain access problem. I've seen some solutions that are indicating to add "Access-Control-Allow-Origin: *", but I don't know where I can do this.

Do I need to create some handler?

I'm using WCF Web API.

Error: XMLHttpRequest cannot load http://localhost:8081/Song/0. Origin http://localhost:8080 is not allowed by Access-Control-Allow-Origin.

EDIT

I've noticed that this is only happens when HTTP method is PUT or DELETE. I can successfully make requests with GET or POST.

I'm making the request using jquery.

$.ajax({
        url: Settings.RESTfulEndPointFor('Song/' + songID),
        type: 'DELETE',
        success: function (response) {
            callback(response);
        }
    });

I don't know why, but it seems like this is resulting in method OPTIONS with Access-Control-Request-Method: DELETE.

Does any one know what causing this?

Any help is appreciated.

score 4 · Answer 1 · answered Oct 29 '12 at 17:58

I had this problem when connecting to a WCF RESTful service via AJAX calls

My javascript was this:

var GetData= function(){

    var data;
    $.ajax({
        url:  this.server + "/data",
        async: false,
        type: "GET",
        success: function (success) {
            data = success;
        }
    });
    return data;

};

My service endpoint was opened with this code

ServiceHost host = new ServiceHost(new MyService());
host.Open();

All the important data is stored in the App.config file, I did not have to change that file for this fix.

I knew I had to add the headers somewhere before the response message was sent.

After some searching and hacking I found the Authorization property of a ServiceHost object. The Authorization property is an instance of the ServiceAuthorizationBehavior class whose objects have a property called ServiceAuthorizationManager which is an instance of the ServiceAuthorizationManager class.

By creating a new class that inherits from the ServiceAuthorizationManager and setting it to the ServiceAuthorizationManager property of the Authorization behavior of your ServiceHost instance, you can intercept all calls to your service.

This is how I have implemented my class

public class MyServiceAuthorizationManager : ServiceAuthorizationManager
{
protected override bool CheckAccessCore(OperationContext operationContext)
{

    HttpResponseMessageProperty prop = new HttpResponseMessageProperty();
    prop.Headers.Add("Access-Control-Allow-Origin", "*");
    operationContext.OutgoingMessageProperties.Add(HttpResponseMessageProperty.Name, prop);

    return true;
}
}

then right after I declare my ServiceHost object (before the host is opened) I add this line

host.Authorization.ServiceAuthorizationManager = new MyServiceAuthorizationManager();

After doing this, rebuilding, and running my service the error message stopped showing up. Hooray!

Lastly, I read an article that described the ServiceHost class was designed for SOAP/WSDL services not RESTful services. For RESTful services the WebServiceHost object should be used.

So

ServiceHost host = new ServiceHost(new MyService());
host.Open();

becomes

WebServiceHost host = new WebServiceHost(new MyService());
host.Open();

You must add references to the following assemblies:

System.ServiceModel.Web

Hope this helps.

Sources:

it worked for me! Thanks a lot. But I keep having "Method:OPTIONS Status Code:405 Method Not Allowed" But the method GET works anyway.. wired! I'm glad it worked! — Eduardo Xavier, Jul 22 '13 at 13:46

score 1 · Answer 2 · answered Jun 10 '11 at 15:19

1

Normally you put this in header of response. So put it in header where you modify/insert other header values like this

header('Access-Control-Allow-Origin: *) //change it according to however header is  set in wcf , since this is php syntax

Point is your response should have this header.

answered Jun 10 '11 at 15:19

Rizwan Sharif

1,089
2
10
20

Hello, thank you for your reply. I've added more information to my question. I can't add this header to my response. This error is raised before requested method is executed. – aumanets Jun 10 '11 at 16:49

score 1 · Answer 3 · answered Jan 27 '12 at 03:43

The request you are seeing with the OPTIONS method and an Access-Control-Request-Method: DELETE header is called a "preflight request". The CORS specification requires this for requests with methods that have side effects (like DELETE) to ensure the resource is ok with the request.

Check out this section of the spec >> http://www.w3.org/TR/cors/#cross-origin-request-with-preflight0

Unfortunately I don't know how to make this type of request work with wcf web api.

score 0 · Answer 4 · answered Jun 11 '11 at 17:02

0

I have created

AllowCrossDomainRequestHandler : DelegatingChannel

and for each response I'm registering this header:

response.Headers.Add("Access-Control-Allow-Origin", "*");

answered Jun 11 '11 at 17:02

aumanets

3,703
8
39
59

score 0 · Answer 5 · answered Dec 26 '11 at 19:07

0

I got this to work using the following response headers:

res.writeHead(200, {
        'Content-Type': 'text/plain',
        'Access-Control-Allow-Methods': 'DELETE, POST, GET, OPTIONS',
        'Access-Control-Allow-Origin': '*'
    });

answered Dec 26 '11 at 19:07

b-h-

2,651
1
18
9

score 0 · Answer 6 · edited May 23 '17 at 12:22

First, with most web browsers there is no way to actually get around the cross-domain restriction. Most won't even let you change the "accept" header. So you have to use JSONP. JSONP is a way of getting JSON data from a cross-domain service, but it is returned in the form of a javascript snippet - which is allowed. The way it works is that you provide the callback function name to the service, then the cross-domain service returns a simple javascript with the actual JSON values embedded as the parameters to your callback function. This is really easy to do now with WCF WebApi (preview 6). Install it in VS 2010 with NuGet. Once you have it installed, look here for more information.

WCF Web API RESTful is not allowed by Access-Control-Allow-Origin

6 Answers6