Hi, I am trying to get CORS to work in Google Chrome, but till now unsuccesfully.
I have the following policies:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ProxyEndpoint name="default">
<Description/>
<FaultRules/>
<PreFlow name="PreFlow">
<Request>
<Step>
<Name>Spike-Arrest</Name>
</Step>
<Step>
<Name>Verify-API-Key-1</Name>
</Step>
<Step>
<Name>remove-query-param-apikey</Name>
</Step>
<Step>
<Name>Quota</Name>
</Step>
</Request>
<Response>
<Step>
<Name>add-cors</Name>
</Step>
</Response>
</PreFlow>
<PostFlow name="PostFlow">
<Request/>
<Response/>
</PostFlow>
<Flows>
<Flow name="OptionsPreFlight">
<Request/>
<Response>
<Step>
<Name>add-cors</Name>
</Step>
</Response>
<Condition>request.verb == "OPTIONS"</Condition>
</Flow>
<Flow name="All">
<Description>...</Description>
<Request/>
<Response/>
<Condition>(proxy.pathsuffix MatchesPath "/") and (request.verb = "GET")</Condition>
</Flow>
</Flows>
<HTTPProxyConnection>
<BasePath>...</BasePath>
<Properties/>
<VirtualHost>...</VirtualHost>
<VirtualHost>...</VirtualHost>
<VirtualHost>...</VirtualHost>
</HTTPProxyConnection>
<RouteRule name="NoRoute">
<Condition>request.verb == "OPTIONS"</Condition>
</RouteRule>
<RouteRule name="default">
<TargetEndpoint>...</TargetEndpoint>
</RouteRule>
</ProxyEndpoint>
and
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<TargetEndpoint name="Batch">
<Description/>
<FaultRules/>
<Flows/>
<HTTPTargetConnection>
<LoadBalancer>
<Server name="..."/>
</LoadBalancer>
<Path>...</Path>
<SSLInfo>
<Enabled>...</Enabled>
<ClientAuthEnabled>...</ClientAuthEnabled>
<KeyStore>...</KeyStore>
<KeyAlias>...</KeyAlias>
<TrustStore>...</TrustStore>
</SSLInfo>
</HTTPTargetConnection>
<PreFlow name="PreFlow">
<Request/>
<Response>
<Step>
<Name>add-cors</Name>
</Step>
</Response>
</PreFlow>
<PostFlow name="PostFlow">
<Request/>
<Response/>
</PostFlow>
</TargetEndpoint>
and the following Javascript:
jQuery.ajax({
url : '...',
type : 'GET',
beforeSend: function (request)
{
request.setRequestHeader("apikey", key),
success : function(result){
console.log(result);
},
error : function(result){
console.log(result);
}
});
And the following add-cors policy:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="add-cors">
<DisplayName>Add CORS</DisplayName>
<FaultRules/>
<Properties/>
<Add>
<Headers>
<Header name="Access-Control-Allow-Origin">*</Header>
<Header name="Access-Control-Allow-Headers">origin, x-requested-with, accept, apikey, authorization</Header>
<Header name="Access-Control-Max-Age">3628800</Header>
<Header name="Access-Control-Allow-Methods">GET, PUT, POST, DELETE</Header>
</Headers>
</Add>
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
<AssignTo createNew="false" transport="http" type="response"/>
</AssignMessage>
And this is the answer I get in the console:
OPTIONS [https://.](https://.). 401 (Unauthorized)
XMLHttpRequest cannot load ... . Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '...' is therefore not allowed access. The response had HTTP status code 401.
Any help is appreciated!