CORS Problem

Garry_Lowther

Your REST Web API appears to disallow cross origin resource sharing (CORS) - I get the following error when attempting to read connections after a successful login from google:

XMLHttpRequest cannot load https://trisys.api.oneall.com/connections/52e82f21-ff7b-42ae-8f45-e3ec45e6a1aa.json?_=1452612544211. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://www.trisys.co.uk' is therefore not allowed access. The response had HTTP status code 405.

My settings allow access from *.trisys.co.uk

Fred_Pinel

Maybe direct connect can help you here.

docs.oneall.com/services/direct-connect/social-login/

Garry_Lowther

This is purely a web browser CORS problem, because when I connect to your ReST API from a non-browser it works without error.

Garry_Lowther

I have chosen to send tokens to my secure Web API to do the connection read from your API.

Fred_Pinel

Good, this is also more secure, and the way we intended it to work.

Claude_Schlesser

Hi Garry,

yes, this is indeed a better solution. The OneAll API Keys should never bee included in a JavaScript file, as these files are disclosed to your visitors.

Regards,