CORS: WorkArounds | Part 1

This piece of writing would try to summaries certain checkpoints all webdevelopers need to ensure when they are working with Cross-Origin Resource Sharing (CORS) :

Domain

So http://www.abc.nyc.com is a domain. Correct. But for your browser http://www.abc.xyz.com:80 and http://www.abc.xyz.com:90 are two different domains. This should be kept in mind always. Surely IE will treat these domains otherwise. Please google up if you are on IE.

Resource Sharing

Internet is the biggest open source community in itself. We constantly share our data when we are on net. Resource sharing can be seen as when a page on web requests for an information from the server which it may or may not own. This is done through http requests. This opens pandora's box of troubles both for service providers and consumers. Which requests to serve(server side) and which replies to accept(client side).

Client side security is implemented by browsers and we will be speaking mainly about that.

Useful Work Arounds:

1. if you control the server and client append this information in your response headers:

                  response["Access-Control-Allow-Origin"] = "*"
 response["Access-Control-Allow-Methods"] = "POST, GET, OPTIONS"
 response["Access-Control-Max-Age"] = "1000"
 response["Access-Control-Allow-Headers"] = "*"

2.to send and receive cookies over CORS:

                    response["Access-Control-Allow-Origin"] = "http://localhost"
   response["Access-Control-Allow-Methods"] = "POST, GET, OPTIONS"
   response["Access-Control-Max-Age"] = "1000"
   response["Access-Control-Allow-Headers"] = "*"
    response["Access-Control-Allow-Credentials"]="true"
you CANNOT set    response["Access-Control-Allow-Origin"] = "*" while using Access-control-origins=true.


3. if you are using ajax on client side and want to send and receive cookies set you xhr request header as:


xhrFields: {
      withCredentials: true
      }


recommended link : https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS