-1

Morning;

Maybe this question was asked before 100 times, but really I can not resolve it . I have this configuration in Apigee that respond to OPTIONS request.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-AddCors">
    <DisplayName>AM-AddCors</DisplayName>
    <Properties/>
    <Add>
        <Headers>
            <Header name="Access-Control-Allow-Origin">*</Header>
            <Header name="Access-Control-Allow-Headers">Content-Length, Content-Disposition, Origin, x-requested-with, Accept, Content-Type, Authorization</Header>
            <Header name="Access-Control-Max-Age">3628800</Header>
            <Header name="Access-Control-Allow-Methods">GET, PUT, POST, DELETE</Header>
        </Headers>
    </Add>
    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
    <AssignTo createNew="false" transport="http" type="request"/>
</AssignMessage>

In the client side I make this call with Angular (HttpClient)

public downloadS2Report(url) {
    let headers = new HttpHeaders();
    let fullurl = environment.config.fundsApi.concat(url);
    headers = headers.set("Authorization", "Bearer *****");
    return this.http.get(fullurl, {headers: headers})
      .map((response:any) => {
        if (response.status == 200) {
          var contentType = 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet';
          var blob = new Blob([(<any>response)._body], {type: contentType});
          return blob;
        }    
      });
  }

I can see the results in the debug view in chrome but I got the famous error with Angular "Access-Control-Allow-Origin' header is present on the requested resource". Do I miss a params in the Apigee config?

enter image description here

enter image description here

enter image description here

georgeawg
  • 48,608
  • 13
  • 72
  • 95
Adouani Riadh
  • 1,162
  • 2
  • 14
  • 37
  • Possible duplicate of [No 'Access-Control-Allow-Origin' header in Angular 2 app](https://stackoverflow.com/questions/36002493/no-access-control-allow-origin-header-in-angular-2-app) – georgeawg Dec 29 '17 at 14:36

1 Answers1

2

You need to respond with the relevant CORS headers on all responses, not just the OPTIONS pre-flight request. So on your GET response you also need:

<Headers>
        <Header name="Access-Control-Allow-Origin">*</Header>
        <Header name="Access-Control-Allow-Headers">Content-Length, Content-Disposition, Origin, x-requested-with, Accept, Content-Type, Authorization</Header>
        <Header name="Access-Control-Max-Age">3628800</Header>
        <Header name="Access-Control-Allow-Methods">GET, PUT, POST, DELETE</Header>
    </Headers>
user184994
  • 17,791
  • 1
  • 46
  • 52