Note that there are some explanatory texts on larger screens.

plurals
  1. POStrategy for CORS - issue with IE10 : xhr status returns 0 for HTTP 401
    primarykey
    data
    text
    <p>I have the following setup on my server:</p> <ul> <li>Apache HTTP Server is serving a BackboneJS frontend application </li> <li>Apache Tomcat is serving a Java based backend (CORS enabled).</li> </ul> <p>Everything is running on a single server that I have full control over.</p> <p>I'm currently using <code>com.thetransactioncompany.cors.CORSFilter</code> in the Java based backend to enable CORS. Everything seens to be working fine.</p> <p>My frontend has the following code to redirect the user to the login page in case an un-authenticated REST call occurred:</p> <pre><code>$.ajaxSetup({ statusCode: { 401: function(){ window.location.replace('/#login'); }, 403: function() { window.location.replace('/#denied'); } }, cache: false }); </code></pre> <p>Everything works fine on all major browsers except for IE10. </p> <p>In IE10, when the non-authenticated users calls the REST serverm the server returns an HTTP 401 (as it should). The XHR object I'm seeing in the IE debugger hoewever seems to have translated this into <code>status = 0</code>. (On chrome you can cleary see that it has <code>status = 401</code>.</p> <p>This appears to be <a href="https://connect.microsoft.com/IE/feedback/details/785990/ie-10-on-win8-does-not-assign-the-correct-status-to-xmlhttprequest-when-the-result-is-401" rel="nofollow">a bug in IE10</a> where IE10 is treating HTTP status 401 as a network error. The console shows:</p> <pre><code>SCRIPT7002: XMLHttpRequest: Network Error 0x80070005, Access is denied </code></pre> <ul> <li><p>Is there a way to workaround this ? I can add handling for statusCode 0 in the <code>ajaxSetup</code> but that seems more of a hack.</p></li> <li><p>Is there a way to disable CORS altogether through some kind of Apache / Tomcat configuration ? </p></li> </ul> <p>Currently my apache configuration is setup using vhosts so that the following public URLs map their corresponding internal hostname / ports.</p> <pre><code>http://mywebapp.com -&gt; http://myrealservername:8080/ -&gt; /var/www/http http://myrestapi.com -&gt; http://myrealservername:8088/ -&gt; /usr/local/tomcat/webapps/restapi </code></pre> <p>Would it be possible / advisable to have Apache </p> <ul> <li>continue serving the static webapp from <a href="http://mywebapp.com/restapi" rel="nofollow">http://mywebapp.com/restapi</a> </li> <li>exposing the REST API on <a href="http://mywebapp.com/restapi" rel="nofollow">http://mywebapp.com/restapi</a> (keeping it "inside" the webapp).</li> </ul> <p>If such a setup were possible I wouldn't need CORS anymore ? It would keep things a lot simpler while increasing browser support ?</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload