No 'Access-Control-Allow-Origin' header is present. XmlHttpRequest

Question

I got XmlHttpRequest object, and i'am trying to send long html data string to Asp Net Core, to make out of it content PDF file. But still getting CORS policies. Even-though i have "Access-Control-Allow-Origin" in my header, it still an issue for me. Already tried everything with CORS. Installed cors for Asp net Core, nothing changed. Everything works fine if i use my HTML document from local.

Full error:

Access to XMLHttpRequest at 'https://.../getInfoWindowPdf?' from origin 'https://...' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

function infoWindowPdf()
{
    // Create request
    let http = new XMLHttpRequest(); //XMLHttpRequest XDomainRequest
    let url = backend + "getInfoWindowPdf?";

    // Add in htmlContent header
    let htmlContent = "<style>" + style +"</style>";

    // Get needed content
    let infoWindow = document.querySelector("#section-library-modal");

    //Waits for backend to create file after all open it and remove created temporary files
    http.onreadystatechange = function()
    {
        if(http.readyState == 4)
        {
            window.open(backend + 'InfoPdf?filePath=C:\\Projects\\Web\\WebSections\\wkhtmltopdf\\bin\\pdf-export\\' + sectionName + ".pdf", '_blank');
            setTimeout(() => {getDBData('removepdf?filePath=C:\\Projects\\Web\\WebSections\\wkhtmltopdf\\bin\\pdf-export\\&filename=' + sectionName);}, 100);
        }
    };

    http.open("POST", url, true);
    http.setRequestHeader('Access-Control-Allow-Origin', '*');
    http.setRequestHeader('Content-type', 'application/x-www-form-urlencoded'); //application/x-www-form-urlencoded
    http.send(params);
}

My Asp Net Core Startup Config for CORS.

readonly string MyAllowSpecificOrigins = "_myAllowSpecificOrigins";

  public void ConfigureServices(IServiceCollection services)
    {
        services.AddCors(options =>
        {
            options.AddPolicy(MyAllowSpecificOrigins,
            builder =>
            {
                builder.WithOrigins("http://localhost:5000",
                                    "http://localhost:5000/websections/getInfoWindowPdf?"
                                    ).AllowAnyHeader().AllowAnyMethod();
            });
        });

        services.Configure<CookiePolicyOptions>(options =>
        {
            // This lambda determines whether user consent for non-essential cookies is needed for a given request.
            options.CheckConsentNeeded = context => true;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        });

        services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
    }

 public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
            app.UseHsts();
        }

        app.UseCors(MyAllowSpecificOrigins);

        //app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseCookiePolicy();

        app.UseMvc(routes =>
        {
            routes.MapRoute(
                name: "default",
                template: "{controller=Home}/{action=Index}/{id?}");
        });
    }

Edit: Do not even try to work with Xmlhttprequest, if you want send some data to your backend project. Just use backend straight.

I've had the same kind of issue a few days ago. Turn out, it's not a CORS issue; but that's how it's treated. In my case, I had not started the asp.net core project (yes, I'm sometimes that dumb). — DoctorPrisme, Mar 25 '19 at 12:56
Don't think its something else than CORS. My button works if i open HTML file from local. But have this error if open the same HTML from Asp. — narayana raghavendra, Mar 25 '19 at 12:58
What's your CORS policy in the .net core app? You should have something in the startup.cs and/or an extension that sets your policy. You should not have anything in your request, that's not needed. — DoctorPrisme, Mar 25 '19 at 13:01
the `Access-Control-Allow-Origin` header must be set in the recieved answer, not the request. — Seblor, Mar 25 '19 at 13:12
If you set CORS as you show in the post, the header is added automatically. (Also, another question that might be unrelated : where does the "style" variable comes from ?) Can you try by replacing "withOrigins()" by "allowanyorigins" ? This will help diagnose the issue. — DoctorPrisme, Mar 25 '19 at 13:37
I removed style from code, to make it shorter. So this is needed variable. — narayana raghavendra, Mar 25 '19 at 13:38
Place AllowAnyOrigin didn't help.. ((, so tired of this error...... — narayana raghavendra, Mar 25 '19 at 13:42
Your error message, despite the truncating you did to it, shows that your origin starts `https://` but all the origins you allow start with `http://`. You appear to just made a typo in your list of acceptable origins. — Quentin, Mar 28 '19 at 09:54

score 0 · Answer 1 · answered Mar 25 '19 at 13:10

0

Install the CORS nuget package.

Install-Package Microsoft.AspNetCore.Cors

Add CORS services in ConfigureServices

public void ConfigureServices(IServiceCollection services)
{
  services.AddCors();
}

In Configure method of Startup.cs file

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    app.UseCors(
        options => options.WithOrigins("http://example.com").AllowAnyMethod()
    );
    app.UseMvc();
}

answered Mar 25 '19 at 13:10

Eryk Korzeniowski

81
3

tried your exact variant, even i tried it before, still getting the same error. – narayana raghavendra Mar 25 '19 at 13:22
if you use chrome, can you see what request / response headers are present in network tab after sending a request? – Eryk Korzeniowski Mar 25 '19 at 13:43
wait, response tab contains nothing.., and there is no response header at all, only request header – narayana raghavendra Mar 25 '19 at 14:09

No 'Access-Control-Allow-Origin' header is present. XmlHttpRequest

1 Answers1

Linked