0

I am trying to make an AJAX call to a server within our intranet, but I can't seem to get the headers right.

The code for my call is as follows:

        $('#btn-create-ticket').click( function(event) {
        $.ajax({
            type: "GET",
            dataType: "json",
            beforeSend: function (xhr)
            {
                xhr.setRequestHeader("Access-Control-Allow-Origin", "*");
                xhr.setRequestHeader ("Authorization", "Basic " + btoa("username" + ":" + "password"));
            },
            url: "http://myservername:3336/sdata/slx/dynamic/-/accounts%28%27"+$("#slx-accountid").val()+"%27%29/Contacts?format=json", 
            async: false, 
            success: function(result){
                var obj = jQuery.parseJSON( result );
                //REMAINING CODE TO GO HERE 
            }
        });
    });

This is a call to the SalesLogix SData API, which should return a chunk of JSON. My problem is that I keep getting the following error:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://myservername:3336/sdata/slx/dynamic/-/accounts%28%27A6UJ9A0013SN%27%29/Contacts?format=json. (Reason: CORS header 'Access-Control-Allow-Origin' missing).

So, after a little research I have added in what I believe to be the correct headers, but I still can't get it to work. Fiddler is also telling me things which don't make sense. If I look at the HEADERS in Fiddler, I can clearly see the headers I expect:

access-control-allow-origin,authorization

But, under the AUTH tab it states:

No Authorization Header is present.

I have also tried (as suggested in a number of posts) changing the dataType to JSONP but this has no effect (probably because I am using JQuery v2.1.4 which appears to default to this in these circumstances).

Has anyone any suggestions?

Cheers Si

EDIT

Have added in the headers as follows on the server: Screenshot of headers

Now getting:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://myservername:3336/sdata/slx/dynamic/-/accounts...... (Reason: CORS preflight channel did not succeed).
Si Stone
  • 121
  • 2
  • 12
  • possible duplicate of [Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at](http://stackoverflow.com/questions/24182259/cross-origin-request-blocked-the-same-origin-policy-disallows-reading-the-remot) – rrk Aug 10 '15 at 11:53
  • `jsonp` will only work if the callback paramter is added to the json response by the server side script. – martincarlin87 Aug 10 '15 at 11:56
  • never use `async:false` . It is being deprecated by browser vendors and is terrible practice as it completely blocks the UI. – charlietfl Aug 10 '15 at 12:03
  • `added in what I believe to be the correct headers` ... no, access control headers must be set at server – charlietfl Aug 10 '15 at 12:06
  • Use of async:false is irrelevant here - and its there for debugging only. I am aware of the deprecation and UI impact, but this site is only in development at the minute – Si Stone Aug 10 '15 at 12:29
  • Have added in server side response headers - see edit – Si Stone Aug 10 '15 at 12:33

0 Answers0