使用setRequestHeader时，在IIS（ASP.net）上使用CORS的跨站点AJAX失败

Question

OK, so I am trying to enable CORS on my ASP.net server so that I can test some javascript against my Web API using jsFiddle. My web forms page calls the EnableCors function (below) on the pageInit event.

Public Sub EnableCors(Optional Origin As String = "", Optional Methods As String = "", Optional Headers As String = "")
    Response.Headers.Add("Access-Control-Allow-Origin", vbNVL(Origin, "*"))
    Response.Headers.Add("Access-Control-Allow-Methods", vbNVL(Methods, "*"))
    Response.Headers.Add("Access-Control-Allow-Headers", vbNVL(Headers, "*"))
    Response.Headers.Add("Access-Control-Expose-Headers", "Access-Control-Allow-Origin")
End Sub

The vbNVL function simply replaces any empty string with the second parameter value. So, the values for the first 3 headers just end up being "*" if no parameters were passed to the Sub.

Using my jsFiddle , everything works great until I append header values to the request object, then it fails saying "CORS header 'Access-Control-Allow-Origin' missing". Please take a look at the fiddle, and toggle setHeaders variable to false on line one to see it succeed. Line 31 is where the variable is being used. This is a super simple example.

Can someone please help me figure out why this fails when I use the setRequestHeader method on the XMLHttpRequest object? Thanks!

Answer 1

Have you tried adding the enableCors attribute to the top of your WebAPI contronller, Ie

[EnableCors(origins: "http://youroriginaddress.com", headers: "*", methods: "*")]

The following tutorial should be of help to you also:

http://www.asp.net/web-api/overview/security/enabling-cross-origin-requests-in-web-api

Let me know how it goes. ;)