How Do Preflight Options Requests Enable Cross-Domain HTTP Access to WCF Services?

Accessing WCF Services Cross-Domain with Preflight Options Requests

When attempting cross-domain HTTP requests to WCF services, it's essential to account for CORS limitations. This article explores how to preflight an HTTP request using OPTIONS to overcome these obstacles.

The Preflight Process

Before sending an actual request, browsers preflight the request using an OPTIONS request to determine if the server allows the request. This step includes sending two special request headers:

• Access-Control-Request-Method: Specifies the HTTP method of the actual request (e.g., GET, POST)
• Access-Control-Request-Headers: Lists any custom headers that will be included in the actual request

Server-Side Response

To accommodate these preflight requests, the server should respond with appropriate headers:

• Access-Control-Allow-Origin: Specifies the origins allowed to access the resource
• Access-Control-Allow-Methods: Lists the HTTP methods allowed for the resource
• Access-Control-Allow-Headers: Enumerates the custom headers that are permitted in the actual request

Preflight with jQuery.getJSON

Using jQuery.getJSON for GET requests requires preflighting with an OPTIONS request. This can be implemented as follows:

<code class="javascript">$.ajax({
  url: "http://your.wcf.endpoint",
  type: "OPTIONS",
  success: function(data) {
    console.log("Preflight successful:", data);
  }
});

$.getJSON("http://your.wcf.endpoint", function(data) {
  console.log("Actual GET request:", data);
});</code>

Example Response Headers

Consider an incoming preflight request with the following headers:

Origin: http://yourdomain.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: X-Custom-Header

The server should respond with:

Access-Control-Allow-Origin: http://yourdomain.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: X-Custom-Header

The Access-Control-Request-Headers must be echoed in the Access-Control-Allow-Headers response, and the '*' wildcard is not allowed.

The above is the detailed content of How Do Preflight Options Requests Enable Cross-Domain HTTP Access to WCF Services?. For more information, please follow other related articles on the PHP Chinese website!