StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POCORS Headers appended to HTTP Response not Sent to Browser
text
Body
copied!<p>I am writing directly to the request headers in an ASP.NET MVC via the <code>HttpContext.Current</code> object and yet these headers are not being sent to the browser... Any idea what could cause this? I ONLY get the headers if I add them via the web.config. This does not work for me as I need to allow multiple domains to <code>Access-Control-Allow-Origin</code>.</p> <p>I attempted to write the headers directly to <code>HttpContext.Current</code> using this code.</p> <pre><code>context.Response.AppendHeader("Access-Control-Allow-Origin", origin); context.Response.Cache.SetCacheability(HttpCacheability.NoCache); context.Response.ContentType = "text/plain"; context.Response.Write("Hello World " + DateTime.Now.ToString()); </code></pre> <p>I get the hello world but not the headers.</p> <p>I have also attempted to use <code>Thinktecture.IdentityModel.Http.Cors.WebApi</code> but get the same results, which is nothing. I have checked an rechecked my code to be sure it conforms to the tutorial]<a href="http://brockallen.com/2012/06/28/cors-support-in-webapi-mvc-and-iis-with-thinktecture-identitymodel/" rel="nofollow">1</a>. I have configured the headers in the Web.config and attempted via Thinktecture however I only get the headers when <code>Access-Control-Allow-Origin</code> is in the web.config but I still get an error in Chrome/FF. It seems like the headers are only being sent on the OPTIONS request but I am not certain.</p> <pre><code>Accept:*/* Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3 Accept-Encoding:gzip,deflate,sdch Accept-Language:en-US,en;q=0.8,ga;q=0.6,pt-BR;q=0.4,pt;q=0.2 Access-Control-Request-Headers:accept, origin, content-type Access-Control-Request-Method:GET Authorization:Negotiate REDACTED Cache-Control:max-age=0 Connection:keep-alive Host:bpapi.domain.com Origin:http://dev-02 Referer:http://dev-02/_Layouts/PAR/NewParItem.aspx User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.43 Safari/537.31 HTTP/1.1 200 OK Server: Microsoft-IIS/7.5 Persistent-Auth: false X-Powered-By: ASP.NET Access-Control-Allow-Origin: http://dev-02 Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept WWW-Authenticate: Negotiate REDACTED Date: Sat, 06 Apr 2013 00:35:31 GMT Content-Length: 0 </code></pre> <p>Here is the <a href="http://pastebin.com/AjGLwtLj" rel="nofollow">web.config as a pastebin</a> so as not to clutter up the question. WebDAV is <strong><em>not</em></strong> installed.</p> <pre><code>public class CorsConfig { public static void RegisterCors(HttpConfiguration httpConfig) { WebApiCorsConfiguration corsConfig = new WebApiCorsConfiguration(); corsConfig.RegisterGlobal(httpConfig); corsConfig .ForResources(new string[] { "Industries", "Projects" }) .ForOrigins(new string[] { "http://dev-01", "http://dev-02" }) .AllowAll(); } } </code></pre> <p>Here is the Thinktecture code:</p> <pre><code> protected void Application_Start() { AreaRegistration.RegisterAllAreas(); WebApiConfig.Register(GlobalConfiguration.Configuration); FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters); RouteConfig.RegisterRoutes(RouteTable.Routes); BundleConfig.RegisterBundles(BundleTable.Bundles); //CorsConfig.RegisterCors(GlobalConfiguration.Configuration); RegisterCors(MvcCorsConfiguration.Configuration); } private void RegisterCors(MvcCorsConfiguration corsConfig) { corsConfig .ForResources(new string[] {"Industries", "Projects" }) .ForOrigins(new string[] { "http://dev-01", "http://dev-02" }) .AllowAll(); } </code></pre> <p><strong>Update 2013/04/09:</strong> Neither <code>context.Response.AppendHeader(...)</code> nor <code>context.Response.AddHeader(...)</code> have any effect. Chrome and FF seem to be OK if they get JSONP regardless of the allow origin header so my project at the very least works. I have also tried <code><remove name="OPTIONSVerbHandler"/></code> with no success. I will be deploying the MVC app to a new server to see if it is something localized to the specific machine.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload