1

I am wondering if it is possible to do conditional cross-domain calls to the service only when a "vendor key" is given to an authorised 3rd party.

Remotely:

When the service is called by some authorised remote server, service enables CROS feature, but a "vendor key" is required as a parameter or cookies.

Locally:

When the service is called by its own web server, ajax calls are accepted as usual. The "vendor key" parameter is not required when local server hits a CROS service.

Could you please give me some direction on how to implement it?

Tom
  • 15,781
  • 14
  • 69
  • 111

1 Answers1

1

Here's the implementation of the EnableCors Request Filter Attribute.

Just change the implementation to look at the incoming IHttpRequest and only print the headers when your conditions are met.

You can also do this with a global request filter or adhoc, manually - in your service implementation.

Community
  • 1
  • 1
mythz
  • 141,670
  • 29
  • 246
  • 390