Cross domain call error : XMLHttpRequest: Network Error 0x80070005, Access is denied

Question

Using MVC Asp.Net

Below code works with actual user name and password. But I do not want to use it. :

WebClient client1 = new WebClient();
client1.Credentials = new NetworkCredential("actualUserName", "actualPassword");
string code1 = client1.DownloadString(@"http://Domainname/GetValue");

Tried the javascript approach :

 $.ajax({
    type: 'POST',
    url: Url,
    processData: false,
    contentType: 'application/json; charset=utf-8',
    dataType: 'jsonp',
    crossDomain: true,
    jsonpCallback: 'CallBackMethod',
    success: function (json) {
        console.log(json); 
    },
    error: function (xhr, textStatus, errorThrown) {
        console.log(errorThrown);
    }
});

But getting the below error :

Multiple Access-Control-Allow-Origin headers are not allowed for CORS response.
XMLHttpRequest: Network Error 0x80070005, Access is denied.

Tried to add the header in Global.asax in Application_BeginRequest and similar entries in webconfig :

HttpContext.Current.Response.AddHeader("Access-Control-Allow-Origin", "*");

if (HttpContext.Current.Request.HttpMethod == "OPTIONS")
{
    HttpContext.Current.Response.AddHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
    HttpContext.Current.Response.AddHeader("Access-Control-Allow-Headers", "Content-Type, Accept");
    HttpContext.Current.Response.AddHeader("Access-Control-Max-Age", "1728000");
    HttpContext.Current.Response.End();
}

All the above were tried and it does not work from Win7 machine. But works from Win10 machine!! Also tried to deploy in server and checked, but same errors pops up.

Answer 1

The key to your problem is right in the error message:

Multiple Access-Control-Allow-Origin headers are not allowed

The server is responding with duplicate headers. That's causing some browsers to fail. You mentioned you implemented CORS in two places. That's a good place to start. Remove one implementation and see what happens.

There are frameworks that implement CORS as well. The bottom line is that you only need one, and one that works best. Whatever implementation you keep, it needs to handle standard requests and preflight requests (OPTIONS) as well.

Answer 2

Below fixed the issue :

IIS -> Authentication -> Windows Authentication -> Providers -> Remove Negotiate