Angular和Firefox告诉我我的OAuth调用响应错误，Fiddler告诉我否则

Question

I'm developing a Cordova app and need to authenticate via OAuth with my Drupal backend. I'm trying to get a request token. I'm receiving a 200 response and with Fiddler I can see I'm getting my token:

I must say that I got the following message from Fiddler:

Response is encoded and may need to be decoded before inspection. Click here to transform.

The screenshot is taken after I clicked to decode.

But Angular is entering the error function of $http and Firefox tells me the response is empty:

The request headers sent from Angular tell my service it accepts application/json and plain/text (and */* ).

So can anyone tell me why Fiddler is telling me there is a response, while Firefox and Angular tell me otherwise? Is it the decoding? If so, I would expect I could add a function to my $http to transform the response. But in that function, I can see the data parameter is "" (an empty string).

UPDATE

I think the cause is the the response is sent in 'chunked' format. And Angular's $http can't handle chunked responses. Now to find out why my server/Drupal is sending a chunked response for such a small response and how to avoid it. Or how to accept chunked reponses in Angular.

UPDATE 2

I've managed to put this behavior in a fiddle using jQuery. The resource it's calling is unprotected, so my question has little to do with OAuth (I'll try to rewrite it later). I'm not sure if it's the chunked response or CORS.

But via Fiddler, I can see I'm getting a response with all the data in it (the same data you see in your browser when you surf to the resource . Although you have to 'unchunk' it in Fiddler first.

Or is my browser blocking it because of CORS, even though the response returns?

Answer 1

If you hit F12 and look at your browser's error console, you will see:

XMLHttpRequest cannot load http://www.gentlesite.be/drupal/api/nodes. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://fiddle.jshell.net' is therefore not allowed access.

Same-Origin-Policy prevents your JavaScript from reading content from another site unless the other site explicitly opts-in. See this post for an introduction to Same-Origin-Policy.