2

I'm attempting to make a cross domain GET request on android 2.3.3. I'm using CORS Filter on the server. I have tested this on chrome, firefox, iphone and it works fine. With android 2.3.3 the preflight request looks good, but the actual request isn't sending the Origin header. I'm getting the data back just fine but the ajax errors out with a status 0. I tried changing it to a POST request and that worked!!!

Here is the ajax code:

...

$.ajax( {
    beforeSend: function (xhr, settings) {
        xhr.withCredentials = true;
        xhr.setRequestHeader('Authorization', 'Bearer myoathtoken');
    },
    dataType: "json",
    type: "GET",
    url: getMyUrl() + '/data.json',
    success: function(data) {
        alert("It works");
    }
});

Here are the results for the get (doesn't work)

OPTIONS http://test2.mydomain:9990/data.json HTTP/1.1
Host: test2.mydomain:9990
Accept-Encoding: gzip
Accept-Language: en-US
Access-Control-Request-Headers: Authorization, Accept
Cookie: mycookie=mycookieval
Accept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7
Referer: http://test.mydomain:9990/
User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; sdk Build/GRI34)         AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
Origin: http://test.mydomain:9990
Access-Control-Request-Method: GET
Accept: text/xml, text/html, application/xhtml+xml, image/png, text/plain, */*;q=0.8

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Access-Control-Allow-Origin: http://test.mydomain:9990
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: HEAD, GET, OPTIONS, POST
Access-Control-Allow-Headers: Authorization, X-Requested-With, Origin, Accept, Content-Type
Content-Length: 0
Date: Fri, 03 Feb 2012 21:29:05 GMT

GET http://test2.mydomain:9990/data.json HTTP/1.1 
Host: test2.mydomain:9990
Accept-Encoding: gzip
Referer: http://test.mydomain:9990/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; sdk Build/GRI34)        AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
Cookie: mycookie=mycookieval
Authorization: Bearer oauthtoken
Accept: application/json, text/javascript, */*; q=0.01
Accept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-cache
Content-Type: application/json;charset=UTF-8
Transfer-Encoding: chunked
Date: Fri, 03 Feb 2012 21:29:08 GMT

Here are the result for sending a post (works)

OPTIONS http://test2.mydomain:9990/data.json HTTP/1.1
Host: test2.mydomain:9990
Accept-Encoding: gzip
Accept-Language: en-US
Access-Control-Request-Headers: Authorization, Accept
Cookie: mycookie=mycookieval
Accept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7
Referer: http://test.mydomain:9990/
User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; sdk Build/GRI34) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
Origin: http://test.mydomain:9990
Access-Control-Request-Method: POST
Accept: text/xml, text/html, application/xhtml+xml, image/png, text/plain, */*;q=0.8

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Access-Control-Allow-Origin: http://test.mydomain:9990
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: OPTIONS, POST, HEAD, GET
Access-Control-Allow-Headers: Authorization, X-Requested-With, Origin, Accept, Content-Type
Content-Length: 0
Date: Fri, 03 Feb 2012 21:21:30 GMT

POST http://test2.mydomain:9990/data.json HTTP/1.1
Host: test2.mydomain:9990
Accept-Encoding: gzip
Accept-Language: en-US
Cookie: mycookie=mycookieval
Authorization: Bearer oauthtoken 
Accept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7
Referer: http://test.mydomain:9990/
User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.3; en-us; sdk Build/GRI34) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
Origin: http://test.mydomain:9990
Accept: application/json, text/javascript, */*; q=0.01
Content-Length: 0

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Access-Control-Allow-Origin: http://test.mydomain:9990
Access-Control-Allow-Credentials: true
Cache-Control: no-cache
Content-Type: application/json;charset=UTF-8
Transfer-Encoding: chunked
Date: Fri, 03 Feb 2012 21:21:32 GMT

I did a little more testing and took the authorization header out of equation and it worked with doing a GET. Not sure why the authorization header would cause it to fail for get requests. Any ideas?

5
  • I've created a simple test page to test CORS requests. Can you try your request out in Android and see what the response is: client.cors-api.appspot.com/…
    – monsur
    Feb 6, 2012 at 20:30
  • Thanks for the response! Sending GET request to server.cors-api.appspot.com/server? id=6058740&httpstatus=200&methods=GET&headers=Authorization , with custom headers Fired XHR event: loadstart Fired XHR event: readystatechange Fired XHR event: error XHR status: 0 XHR status text:
    – bmurmistro
    Feb 6, 2012 at 20:46
  • I get the same response for android 2.2, 2.3, and 3.x. For what it's worth, the console log returns this in 3.x: E/browser ( 333): Console: XMLHttpRequest cannot load server.cors-api.appspot.com/…. Origin client.cors-api.appspot.com is not allowed by Access- Control-Allow-Origin. null:1
    – bmurmistro
    Feb 6, 2012 at 21:11
  • This chart indicates that CORS support should work on those Android versions: caniuse.com/cors Though this may be an edge case bug. I'm using Android 4.0.3 and it works. Perhaps you can just continue using POST for now?
    – monsur
    Feb 6, 2012 at 22:01
  • Thanks for taking a look. Yes, using post is a workaround I may end up using.
    – bmurmistro
    Feb 6, 2012 at 23:11

1 Answer 1

1

I have the same problem, however it is not a problem with authorization header but with the missing Origin Header in the GET request. That is also why the post request is working - there is an Origin Header and the Origin Header is mandatory for CORS.

Stange thing is that the OPTIONS Preflight call has an Origin Header set.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.