CORS（跨源资源共享）https不起作用（IIS托管的启用WCF Rest的端点）

Question

Hi hoping that someone can help

I have been looking at getting a simple prototype working using CORS to WCF over https. We have implemented a solution and tested it in http and it works fine. As soon as we try and call the WCF endpoints using https we just get a "404 Not Found" in this case. But in our production code I get a "400 Bad request" which I will post about later! For now I would like help with the 404 error.

I have searched and tried many things but still not got it working!

I have written a little test web project and WCF endpoints that works fine in http.

On the client side I am making an jquery ajax request to the following endpoint

var theUrl = "https://myhostmachine/Cors/service.svc/web";
function makeGetDataJQueryRequest() {
    $.support.cors = true;
    $.ajax({
        url: theUrl + "/GetData?value=24",
        contentType: "application/json; charset=utf-8",
        type: "POST",
        cache: false,
        dataType: "json",
        //                data: undefined,
        success: function (response) {
            alert("success");
        },
        error: function (a, b, c) {
            alert("error");
        }
    });
}

On the server I have my WCF code that does all the preflight cors response and as I say working in http.

1. I have setup a self signed certificate and used that in my IIS, also making sure to add it the my certificate store via the mmc plugin.

2. When I make the request straight away I can see that it is not sending an OPTIONS request, so why not? But it does sent it via http?

Fiddler Request:

POST https://myhostmachine/Cors/service.svc/web/GetData?value=24 HTTP/1.1
Host: hsw10530.cse-servelec.com
Connection: keep-alive
Content-Length: 0
Accept: application/json, text/javascript, */*; q=0.01
Origin: https://myhostmachine
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.103 Safari/537.36
Content-Type: application/json; charset=utf-8
Referer: https://hsw10530.cse-servelec.com/CorsClient/
Accept-Encoding: gzip,deflate
Accept-Language: en-US,en;q=0.8
Cookie: ASPSESSIONIDCGCSARDQ=IFNPFPKAJIMFCJHEANDFOBCH

Response:

HTTP/1.1 404 Not Found
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 11 Sep 2014 09:36:51 GMT
Content-Length: 0

The Web.config is as follows:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>


  <system.web>
    <compilation debug="true" />
  </system.web>

  <system.serviceModel>

    <behaviors>
      <serviceBehaviors>
        <behavior>
          <serviceMetadata httpGetEnabled="True" />
          <serviceDebug includeExceptionDetailInFaults="True" />
        </behavior>
      </serviceBehaviors>

      <endpointBehaviors>
        <behavior name="restBehaviour">
          <webHttp />
          <CorsSupport />
        </behavior>
      </endpointBehaviors>

    </behaviors>

    <extensions>
      <behaviorExtensions>
        <add name="CorsSupport" type="WcfService.Cors.CorsSupportBehaviorElement, WcfService" />
      </behaviorExtensions>
    </extensions>

    <bindings>
      <webHttpBinding>
        <binding name="CORSWebHttpBinding" crossDomainScriptAccessEnabled="True" maxReceivedMessageSize="2147483647" maxBufferSize="2147483647">
          <readerQuotas maxDepth="32" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647" />
          <security mode="Transport">
          </security>
        </binding>
      </webHttpBinding>
    </bindings>

    <services>
      <service name="WcfService.Service1">
        <host>
          <baseAddresses />
        </host>
        <endpoint address="" binding="wsHttpBinding" contract="WcfService.IService1" />
        <endpoint address="web" binding="webHttpBinding" bindingConfiguration="" behaviorConfiguration="restBehaviour" contract="WcfService.IService1" />
        <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
      </service>
    </services>

  </system.serviceModel>

</configuration>

Below is the WCF code or at least the important bit that does all the preflight cors stuff.

public class CorsMessageInspector : IDispatchMessageInspector
    {
        public object AfterReceiveRequest(ref Message request, IClientChannel channel, InstanceContext instanceContext)
        {
            HttpRequestMessageProperty httpRequest = request.Properties["httpRequest"] as HttpRequestMessageProperty;

            // Check if the client sent an "OPTIONS" request
            if (httpRequest != null)
            {
                if (httpRequest.Method == "OPTIONS")
                {
                    // Store the requested headers
                    OperationContext.Current.Extensions.Add(new PreflightDetected(
                        httpRequest.Headers["Access-Control-Request-Headers"]));
                }
            }
            return null;
        }

        public void BeforeSendReply(ref Message reply, object correlationState)
        {
            HttpResponseMessageProperty property = null;

            if (reply == null)
            {
                // This will usually be for a preflight response
                reply = Message.CreateMessage(MessageVersion.None, null);
                property = new HttpResponseMessageProperty();
                reply.Properties[HttpResponseMessageProperty.Name] = property;
                property.StatusCode = HttpStatusCode.OK;
            }
            else
            {
                property = reply.Properties[HttpResponseMessageProperty.Name] as HttpResponseMessageProperty;
            }

            PreflightDetected preflightRequest = OperationContext.Current.Extensions.Find<PreflightDetected>();
            if (preflightRequest != null)
            {
                // Add allow HTTP headers to respond to the preflight request
                if (preflightRequest.RequestedHeaders == string.Empty)
                    property.Headers.Add("Access-Control-Allow-Headers", "Accept");
                else
                    property.Headers.Add("Access-Control-Allow-Headers", preflightRequest.RequestedHeaders + ", Accept");

                //http://hsw10530.cse-servelec.com
                property.Headers.Add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
            }

            // Add allow-origin header to each response message, because client expects it
            property.Headers.Add("Access-Control-Allow-Origin", "*");
        }
    }

Your help would be greatly appreciated, if you have ever been able to setup CORS over ssl and what did you do to get it to work?

Many thanks Andrew

Answer 1

Ok I got it working, after all that I just needed to provide the bindingConfiguration as my endpoint at the bottom of the config had this as an empty string

So the config file did have it in; it I just had not specified this. You can also see that the security mode was Transport for ssl, otherwise over standard http this should be set to None.

<endpoint address="web" binding="webHttpBinding" bindingConfiguration="CORSWebHttpBinding" behaviorConfiguration="restBehaviour" contract="WcfService.IService1" />

I also didn't need the crossDomainScriptAccessEnabled="True" on the CORSWebHttpBinding as this seemed to stop it when using http, but was ok on https.