No 'Access-Control-Allow-Origin' - CORS

Question

I try to fetch content via XMLHttpRequest:

var url = 'http://mapy.geoportal.gov.pl/wss/service/SLN/guest/sln/woj.json'

    if (XMLHttpRequest) {
    var request = new XMLHttpRequest();
    if ('withCredentials' in request) {
        request.open('GET', url, true);
        request.withCredentials = 'true';
        request.withCredentials = 'true';
        request.setRequestHeader('Access-Control-Allow-Origin', '*');
        request.send();
    }
}

I am getting next message:

XMLHttpRequest cannot load http://mapy.geoportal.gov.pl/wss/service/SLN/guest/sln/woj.json. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access.

How to fix this? I set Access-Control-Allow-Origin header to *

continu my problem with url : jsonp continue

Pls refer to this SO question http://stackoverflow.com/questions/10636611/how-does-access-control-allow-origin-header-work . It will help you understand and fix the above issue . — Raghavan, Mar 12 '16 at 08:17

score 2 · Answer 1 · edited May 23 '17 at 12:08

2

You attaching Access-Control-Allow-Origin on frontend, but that header shall be added while handling requests on server side. Server should attach Access-Control-Allow-Origin, Access-Control-Request-Method headers to response that's permit performing requests for frontend.

My guess is that you cannot modify way the server handles requests and server doesn't support JSON Padding (JSONP), so you have to use JSON Proxy to fetch that json data ...

See How to add CORS support to server article and How does Access-Control-Allow-Origin header work? SO question to get more info regarding CORS.

edited May 23 '17 at 12:08

Community

1
1

answered Mar 12 '16 at 08:12

Andriy Ivaneyko

20,639
6
60
82

url http://mapy.geoportal.gov.pl/wss/service/SLN/guest/sln/woj.json' is not my service... – user7172 Mar 12 '16 at 08:37
@user7172 JSON Proxy is a tool which would help you, see updated answer – Andriy Ivaneyko Mar 12 '16 at 08:50

MehulJoshi · Answer 2 · 2019-06-20T02:38:46.043

-3

CORS is browser only thing.

When you try to access some resource from current origin(current domain) to another domain, browser block this request.

Now the server or whatever that is you're hitting to get resource wants to whitelist your domain it can does so by adding some headers.

edited Jun 20 '19 at 02:38

answered Mar 12 '16 at 08:26

MehulJoshi

879
8
19

No 'Access-Control-Allow-Origin' - CORS

2 Answers2