HERE Geocoder API CORS support

Question

I am using Angular 8 HttpClient to make a GET request to the HERE Geocoder API . But the request is blocked by the browser due to failed CORS preflight request.

Access to XMLHttpRequest at ' https://geocoder.api.here.com/6.2/geocode.json?app_id=[APP_ID]&app_code=[APP_CODE]&country=hkg&language=en-GB&searchtext=royal%20view%20hotel ' from origin ' http://localhost:4201 ' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.

(My actual app id and app code have been substituted with [APP_ID] and [APP_CODE] in the above message for obvious reasons)

From what I understand (after reading https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS ), the preflight request is sent as an OPTIONS request by the browser. And the browser has failed the (preflight) response from the HERE API server and so blocking the original GET request.

Could this be an issue with the HERE API server responding incorrectly to the preflight OPTIONS request ?
If so, would anyone suggest a good way to simulate the preflight request to check the response from HERE API?

UPDATE - simulating preflight request

I tried to simulate a preflight request from Postman to see what HERE API server was responding with.

Request details are as follows.
Request type: OPTIONS
Url: https://geocoder.api.here.com/6.2/geocode.json
Header params:

Access-Control-Request-Method: GET
Access-Control-Request-Headers: origin, x-requested-with
Origin: http://localhost:4201

Response for the above request.
Status: 404
Response body:

<ns2:Error xmlns:ns2="http://www.navteq.com/lbsp/Errors/1" type="PermissionError" subtype="InvalidCredentials">
    <Details>invalid credentials for </Details>
</ns2:Error>

If I tried to include the query parameters into the URL (to include the app_id, and app_code) like so:
https://geocoder.api.here.com/6.2/geocode.json?app_id=XXXXXXXXXXXXX&app_code=YYYYYYYYYY&country=hkg&language=en-GB&searchtext=royal view hotel

The same error status is returned (404). And the response body looks like this:

<ns2:Error xmlns:ns2="http://www.navteq.com/lbsp/Errors/1" type="PermissionError" subtype="InvalidCredentials">
    <Details>invalid credentials for XXXXXXXXXXXXX</Details>
</ns2:Error>

where XXXXXXXXXXXXX is my app_id parameter value. Obviously this value was substituted for my actual app_id, which is valid and returns results when run from Postman in a normal GET request.

Unless I am missing something in simulating the preflight request, then it would appear the HERE API server is not responding correctly to the preflight.

I would be grateful for any help and suggestions.

Answer 1

In general the HERE Geocoder API does not support OPTIONS method , however it should be possible to use the jsonp approach for the CORS issue. Pretty sure Angular has some libraries which support jsonp, an approach is described in this thread: How to make a simple JSONP asynchronous request in Angular 2?