xmlHttp.getResponseHeader + Not working for CORS

by

First, a little background:

You are using Access-Control-Allow-Headers, which specifies which request headers the client is allowed to send, but you are not specifying which response headers the client is allowed to read. To allow the client to read non-simple response headers, you need to use Access-Control-Expose-Headers. From the HTML5 Rocks CORS page:

During a CORS request, the getResponseHeader() method can only access simple response headers. Simple response headers are defined as follows:

  • Cache-Control
  • Content-Language
  • Content-Type
  • Expires
  • Last-Modified
  • Pragma

If you want clients to be able to access other headers, you have to use the Access-Control-Expose-Headers header. The value of this header is a comma-delimited list of response headers you want to expose to the client.

So, given that new information, you might do:

HttpContext.Current.Response.AddHeader("Access-Control-Expose-Headers", "Set-Cookie");

…but there’s more to it than that.

Now, the actual answer:

There’s one more serious problem here: the XHR specification explictily disallows reading Set-Cookie. That’s because this is functionally a cross-domain cookie-stealing attack.

Suppose domain A makes a cross-domain request to domain B. When domain B sets cookies, it’s setting domain-specific cookies for domain B only. Any attempt by domain A to read domain B’s cookies is a violation of the same-origin policy for cookie access.

I don’t know WCF, so I’m not the sure of best way to actually do what you want, but I’d guess the solution might be to pass an auth token not through cookies (e.g., a X-WCF-Auth header?) that domain A reads and then sets its own cookie.

More Related Contents:

  1. How to get a cross-origin resource sharing (CORS) post request working
  2. XMLHttpRequest Origin null is not allowed Access-Control-Allow-Origin for file:/// to file:/// (Serverless)
  3. What’s the point of the X-Requested-With header?
  4. CORS issue – No ‘Access-Control-Allow-Origin’ header is present on the requested resource
  5. Access-Control-Allow-Origin error sending a jQuery Post to Google API’s
  6. CORS – How do ‘preflight’ an httprequest?
  7. IE9 jQuery AJAX with CORS returns “Access is denied”
  8. XMLHttpRequest cannot load an URL with jQuery
  9. CORS header ‘Access-Control-Allow-Origin’ missing
  10. How to enable CORS in flask
  11. CORS jQuery AJAX request
  12. Ajax using https on an http page
  13. jQuery CORS Content-type OPTIONS
  14. jqGrid does not populate with data
  15. Error :Request header field Content-Type is not allowed by Access-Control-Allow-Headers
  16. How do you send a custom header in a CORS preflight OPTIONS request?
  17. CORS request – why are the cookies not sent?
  18. Bottle Py: Enabling CORS for jQuery AJAX requests
  19. Accessing web Service from jQuery – cross domain
  20. How can I set CORS in Azure BLOB Storage in Portal?
  21. Passing complex objects into a WCF Rest Service
  22. how to avoid cross domain policy in jquery ajax for consuming wcf service?
  23. Allowing frontend JavaScript POST requests to https://accounts.spotify.com/api/token endpoint
  24. jQuery AJAX call results in error status 403
  25. jQuery UI DatePicker – Change Date Format
  26. Select element by exact match of its content
  27. jquery data selector
  28. Use Jquery Selectors on $.AJAX loaded HTML?
  29. What are the drawbacks of using synchronous ajax call?
  30. Validate fields using JQuery validation without any submit?

Leave a Comment