Page 1 of 1

access is denied when using ajaxjson

Posted: Thu Dec 19, 2013 4:58 pm
by sgagn0
I use ajaxjson to retrieve info to display (building html in javascript)
It is working fine using firefox but i get "access is denied" using ie9.
Looks like a cross-domain issue. Should i use something other than ajaxjson?

Re: access is denied when using ajaxjson

Posted: Thu Dec 19, 2013 6:21 pm
by Scott Klement
For security purposes, AJAX can typically only connect to the same server that the page was served from. Is that what you're seeing? You're trying to use AJAX to connect to a different server? If so, can you explain more about what you're trying to accomplish?

Re: access is denied when using ajaxjson

Posted: Thu Dec 19, 2013 6:28 pm
by Scott Klement
I should add... the cross-domain restriction will be the same no matter which ajax library you use. It's a restriction in the browser, not in the JavaScript code.

But, it's not clear to me whether that's what you're seeing or not?

Re: access is denied when using ajaxjson

Posted: Thu Dec 19, 2013 9:08 pm
by sgagn0
We have 2 different http servers configured. One for profound and one for our web services.
From a profound page I do the following:
ajax({
url: "http://ourApacheaddress/ws/getVessels",
postData : "<GetRequest></GetRequest>",
method: "post",
async: true,
handler: infoHandler
});

The response is in XML format. It works fine in Firefox, IE10, but not in IE9 (see attached document for error messages).

Re: access is denied when using ajaxjson

Posted: Thu Dec 19, 2013 10:04 pm
by Scott Klement
That looks like the cross-site scripting problem you described in the first message. As I said before, it'll be a problem to use any AJAX framework this way (not just our ajaxlibrary.js).

To avoid this, you need to make sure you use:
  • same protocol (http or https) as the original page
  • same host name (IP address or domain name) as the original page
  • same port number as the original page
Are you doing that?

Re: access is denied when using ajaxjson

Posted: Thu Dec 19, 2013 10:27 pm
by sgagn0
We were not planning of doing so (having same domain and port) as cross-domain was working fine in firefox and ie10. We were make aware of an issue when someone tried to go on the page using ie9 (which happened only a few days after we started to configure our web services).
Also, our web services will be called from many different applications (intranet, client zone, web site, profound pages), so we would like to have our web services only at one place. Everyone would access web services through the same IP and port (we have setup an apache instance dedicated to our web services)

We are newbies in regards to web services so maybe we are not doing it the right way.

Re: access is denied when using ajaxjson

Posted: Thu Dec 19, 2013 11:07 pm
by sgagn0
I got it to work by using xdr
Something like:
if(window.XDomainRequest){
var xdr = new XDomainRequest();
xdr.open("post", "http://ourwebserviceaddress/ws/getvessels");
xdr.onprogress = function () { };
xdr.ontimeout = function () { };
xdr.onerror = function () { };
xdr.onload = function() {
infoHandler(xdr.responseText);
}
setTimeout(function () {xdr.send("<GetRequest></GetRequest>");}, 0);
}

Re: access is denied when using ajaxjson

Posted: Fri Dec 20, 2013 12:38 am
by Scott Klement
XDomainRequest is a non-standard (Microsoft-only) API. I see that you're looking to see if it exists, first... I assume that if it does not, you are using XHR instead? That might be a good solution.

The other way, of course, is to set up a proxy on your IBM i so that you can point it back to the same server, and it uses the proxy to redirect to the web service.

Re: access is denied when using ajaxjson

Posted: Fri Dec 20, 2013 9:44 am
by sgagn0
It works fine with the proxy, but I am not sure if I did it properly or not.
The only thing I did was adding the following two lines in our Profound configuration:
ProxyPass /ws/ http://OurWebServicesAddress/ws
ProxyPassReverse /ws/ http://OurWebServicesAddress/ws

So when using profound/ws everything is redirect to our web services server.

Is it the right way to do it? If so, i prefer, by far, this method.

Re: access is denied when using ajaxjson

Posted: Fri Dec 20, 2013 7:47 pm
by Alex
It looks to me like you did it properly. This is all that you have to do.