I am trying to make a stand-alone HTML file that makes cross-domain requests via CORS to a RESTful JSON service.
My jQuery ajax request:
var query = $.ajax(
{
type: 'GET',
url: 'http://localhost:8626/Home/About',
contentType: 'application/json',
dataType: 'json',
success: function (response)
{
alert('success');
alert(query.getAllResponseHeaders());
alert($.cookie('SessionID'));
},
error: function (x, e)
{
alert('error ' + e);
}
});
I set the Access-Control-etc headers on the (ASP MVC3) server side:
public ActionResult About()
{
Response.AddHeader("Access-Control-Allow-Origin", "*");
Response.AddHeader("Access-Control-Allow-Methods", "PUT, GET, POST, DELETE");
Response.AddHeader("Access-Control-Allow-Headers", "Content-Type");
Response.SetCookie(new HttpCookie("SessionID", "1234"));
return Json(new { name = "John" }, JsonRequestBehavior.AllowGet);
}
Apart from cookies, everything works well. I get my response JSON data properly.
But I am also sending a cookie back from the server. It isn't showing in the headers as a Set-Cookie, and it isn't showing in the cookies collection. I have read here that to get cookies in a cross-domain request, you need to set the following in the $.ajax call:
xhrFields:
{
withCredentials: true
},
When I add this, the call no longer works, with a JS error:
Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
Clearly it is griping about my Access-Control-Allow-Origin header being "*".
Since this is a flat, stand-alone HTML file (sourced from the disk, not from an HTTP server), Chrome is passing along an Origin header equal to "null". I don't appear to be able to override this value -- when I add a custom Origin header, Chrome apparently disregards it.
If I return Access-Control-Allow-Origin = "null" (matching the Origin header value from the request), I get the JS error:
Origin null is not allowed by Access-Control-Allow-Origin.
So I don't know what to do. I can't get my cookies with the wildcard, and allowing "null" instead doesn't work either.
Is this not possible? Or am I missing a step?
