CORS in custom webservice in CRM Script

RE: CORS in custom webservice in CRM Script

Could you use the addHeader() method for the HTTP class?

RE: CORS in custom webservice in CRM Script

Isn't that only for outgoing headers?

I'm trying to fetch data from SuperOffice - so i don't think that'll work?

RE: CORS in custom webservice in CRM Script

Ah!

Good point. 

Check out this blog by Frode Lillerud.

https://community.superoffice.com/en/developer/blog/building-custom-rest-api-methods-using-crmscript/

RE: CORS in custom webservice in CRM Script

CORS headers are something the server side must send, and then the client will look at them (using a client/browser that supports this, but most modern clients/browsers does).

In your case, SuperOffice Service is the server (your CRMScript). 

So you could try adding CORS headers to allow your client to call online.superoffice.com

A problem you could run into is Pre.flights. A Pre-flight request is sent before the actual request. It normally does not happen on GETS (which seems like what you are calling), but are called on POSTs and some of the other HTTP verbs.

You can read more about CORS here: https://www.codecademy.com/articles/what-is-cors

RE: CORS in custom webservice in CRM Script

Hi, you need to add the CORS related headers. Using the lib-http class there is a AddHttpHeader method you can use. Adding Access-Control-Allow-Origin is probably enough.

RE: CORS in custom webservice in CRM Script

Hi Stian, with regard to pre-flights - how do i get around that? I can see that a pre-flight request typically is a OPTIONS request send before the actual POST request. I guess i should be able to only return the http cors headers when receiving the options command, and not execute the whole script - so the question is, how do i distinguish between which HTTP verbs that are used to call the URL in order to detect that a pre-flight check is carried out by the client, and not the actual POST method?

RE: CORS in custom webservice in CRM Script

We should probably implement this properly, with routes and verbs and CORS support, rather than trying to hack everything together in a script.

You need to add CORS Origin header with a your host name, or a * to allow any webpage to call your script.

Access-Control-Allow-Origin: *

RE: CORS in custom webservice in CRM Script

To resurrect an old topic that seems to still haunt me once in a while;

As mentioned earlier, a pre-flight request uses the OPTIONS method, but that does not seem to be allowed by the IIS hosting SO Online? I can see my "Access-Control-Allow-Origin" header if i'm making a POST or GET request, but OPTIONS returns 405 method not allowed...

I just discovered that in Postman - here i'm requesting the script with a POST or a GET:

as you can see, "Access-Control-Allow-Origin" is present here as i've specified it in the script.

But when i'm requesting the script with OPTIONS to simulate a pre-flight request, look what happens:

So the OPTIONS verb is simply not allowed when calling CRM Scripts?

This is the script i tested with:

%EJSCRIPT_START%
<% 
#setLanguageLevel 3; 
//Set HTTP headers
Map _headers;
_headers.insert("Content-Type", "application/json;charset=utf-8"); 
_headers.insert("Access-Control-Allow-Methods","POST,OPTIONS,GET");
_headers.insert("Access-Control-Allow-Origin","https://online.businessanalyze.com"); 
String posted = getCgiContent();
JSONBuilder jb;
if(posted != ''){ 
try{
     jb.pushObject('');
     jb.popLevel();
}
catch{
    jb.pushObject('');
    jb.addString('Status', 'Error');
    jb.addString('Error', error); 
    jb.popLevel();
}
jb.popLevel();
_headers.insert("Status", "200 OK");
}else{
  jb.pushObject('');
   jb.addString('Status', 'Error');
   jb.addString('Error', 'No input!'); 
  jb.popLevel();
  _headers.insert("Status", "400 NOT FOUND");
}
String h;
for (_headers.first(); !_headers.eof(); _headers.next())
h += _headers.getKey() + ": " + _headers.getVal() + "\n";

setParserVariable("ej.headers", h);
printLine(jb.getString());
%>
%EJSCRIPT_END%

Called via:

https://online2.superoffice.com/CustXXXXX/CS/scripts/customer.fcgi?action=safeParse&includeId=XXX&key=XXX

RE: CORS in custom webservice in CRM Script

Can't read what's in the images... please optimize.

RE: CORS in custom webservice in CRM Script

@Tony: Hope that's better :)