We have recently introduced versioning to our API. We have updated the url, uploadUrl and downloadUrl for the FileManager control. All 'FileOperations' calls work but the 'Upload' and 'Download' calls are returning the following message. How can we change the headers on these calls to allow the Upload/Download to work? Why does the introduction of api versioning cause this error (everything was working before)?
Error:
(Note: the version number for the Api is now included in the url)
Access to XMLHttpRequest at 'https://xxxxx/api/v1.0/SharePoint/Upload' from origin 'http://xxxxxx' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
In the Configure method of the Api's Startup.cs class we have app.UseCors("AllowAllOrigins") set.
Please let us know if you require any code examples.
Regards
James Cullis
|
I have included a file that contains skeleton code for the Startup.cs file from our Api, selected Controller code and the definition of the Javascript FileManager component.
All the changes we have made since introducing the Api versioning are in bold. Before we made these changes all calls were working correctly. Since the changes, only the actions in the 'FileOperations' route operate as expected. The 'Upload' and 'Download' (not included) of files return the error described in the original post.
For example, in the Upload (
public
IActionResult Upload(string path, IList
Attachment: Synfusion_Api_Versioning_6ab20da0.rar
01/07/2021 FYI
As a test I changed the url for the FileManager component to be 'https://xxxxx/api/SharePoint/FileOperations?api-version1.0'. The attributes on the controller were changed from
[Route("api/v{version:apiVersion}/[controller]")]
back to
[Route("api/[controller]")]
I have tested this in Postman using the a more simplified endpoint which just returns a string ('https://xxxxx/api/SharePoint/Get?api-version1.0') and this works correctly (and I can switch to another version 1.1 to return a different value for testing).
Regards
James
The Same Origin Policy (SOP) is a security measure standardized among browsers. It is needed to prevent Cross-Site Request Forgery (CSRF). The "Origin" mostly refers to a "Domain". Same Origin Policy prevents different origins (domains) from interacting with each other, to prevent attacks such as CSRF (Cross Site Request Forgery) through such requests, like AJAX. In other words, the browser would not allow any site to make a request to any other site. Without Same Origin Policy , any web page would be able to access the DOM of other pages.
This SOP (Same Origin Policy) exists because it is too easy to inject a link to a javascript file that is on a different domain. This is actually a security risk ; you really only want code that comes from the site you are on to execute and not just any code that is out there.
If you want to bypass that restriction when fetching the contents with fetch API or XMLHttpRequest in javascript, you can use a proxy server so that it sets the header Access-Control-Allow-Origin to *.
If you need to enable CORS on the server in case of localhost, you need to have the following on request header.
Access-Control-Allow-Origin: http://localhost:9999