XDomainRequest in IE is giving Access is Denied error

Question

This is the code I am using is as follows down below:

I am using IE9 and am unable to see the request being sent in the Network tab. I do have Access-Control headers set in the JSP as:

<% response.setHeader("Access-Control-Allow-Origin", "*");%>

Code to get the AJAX HTML Content from the JSP:

if ($.browser.msie && window.XDomainRequest) {

    var xdr = new window.XDomainRequest();
    xdr.open("GET", "http://dev01.org:11110/crs/qw/qw.jsp?&_=" + Math.random());
    xdr.contentType = "text/plain";
    xdr.timeout = 5000;
    xdr.onerror = function () {
        console.log('we have an error!');
    }
    xdr.onprogress = function () {
        console.log('this sucks!');
    };
    xdr.ontimeout = function () {
        console.log('it timed out!');
    };
    xdr.onopen = function () {
        console.log('we open the xdomainrequest');
    };
    xdr.onload = function() {
        alert(xdr.responseText);
    };
    xdr.send(null);
} else { ...... }

I am getting a Access is Denied Error. Any help would be much appreciated!

Turenne

Answer 1

Requests must be targeted to the same scheme as the hosting page

In your example you are doing request to:

http://dev01 ...

And you should do this from HTTP protocol.

For example: If your site, where js script is located: http://dev.org You can do this:

xhr = new XDomainRequest();
xhr.open("GET", "http://dev01.org?p=1");

but this throws "Access denied":

xhr = new XDomainRequest();
xhr.open("GET", "https://dev01.org?p=1");

Looper

Answer 2

My experience with XDomainRequest is that it doesn't respect Access-Control-Allow-Origin: *. Instead, you must specify the domain. This can be obtained from the HTTP_REFERER header if you need to dynamically generate it, or if you are only expecting requests from one domain you can set it manually. This article might help.

<% response.setHeader("Access-Control-Allow-Origin", "http://dev01.org");%>

Medical