CORS AJAX Call not Successful

Question

I have an AJAX call trying to execute the following CORS request to a Web Server (I am currently testing using only the latest version of Chrome):

var xhr = new XMLHttpRequest(); xhr.open("get", "http://www.web_server_url.com/query", true); xhr.onload = function(){ }; xhr.send(null);

Meanwhile, I am still getting the following message:

XMLHttpRequest cannot load http://www.web_server_url.com/query. Origin http://localhost is not allowed by Access-Control-Allow-Origin.

Would someone know what I am missing?

T.J. Crowder · Accepted Answer · 2013-10-26 14:05:32Z

1

The reason is exactly what it says in the error: The server at www.web_server_url.com is not allowing the localhost origin. It's up to the server to decide whether to allow the origin of the call. In this case, apparently it's not allowing it.

The way CORS works, the server replies to the request (or a "preflight" request) with headers either allowing or disallowing the origin on the basis of the information the browser sends it.

answered Oct 26, 2013 at 14:05

T.J. Crowder

1.1m201 gold badges2k silver badges2k bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

JF0001 Over a year ago

Thank you T.J. Since my request is a get one, using any preflighted parameters wouldn’t change anything, right? The server is the Google Trends one. One would have thought that their server should be opened, no?

JF0001 Over a year ago

Or perhaps because the origin is localhost?

T.J. Crowder Over a year ago

@JF0001: You'll have to look at the Google Trends documentation to see what requests they allow via CORS. It could be that they disallow localhost but allow other hosts, or it could be that they don't support CORS at all (and, for example, expect you to use JSON-P instead).

JF0001 Over a year ago

Actually T.J., I thought that the message “is not allowed by Access-Control-Allow-Origin” originated from the browser, and not the server, no?

T.J. Crowder Over a year ago

@JF0001: In general, the browser gives you that message because the server at the other end disallowed the request. So the message may be from the browser, but it's because of the information the target srever gave it. The browser can't decide whether to allow a cross-origin call on its own (except browsers that disallow all calls from file: protocols and such), it has to ask the target server.

|

Collectives™ on Stack Overflow

CORS AJAX Call not Successful

1 Answer 1

8 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

8 Comments

Related