Hi, trying to add CORS, to the Server (using RestEasy), I did this: https://github.com/aerogear/aerogear-unified-push-server/commit/7ccb2e7fb (and some more variations.... (e.g. see the comment out "Access-Control-Allow-Origin", where I am returing the EXACT Origin)) Here is a JavaScript sample: http://jsfiddle.net/JY6n4/ Just click on the "Register a device" button, and see the errors in the console.... So, I am always (with the above jsFiddle) getting: Origin http://fiddle.jshell.net <http://fiddle.jshell.net/> is not allowed by Access-Control-Allow-Origin. regardless if I use "*" or "http://fiddle.jshell.net" (explicit Origin), on the "Access-Control-Allow-Origin". I always thought that "*" is a wildcard.... allowing everybody and their mother to access the server. BTW. This happens with jQuery _and_ vanilla.js (XHR)..... So....... I am really overasked, but ... is it possible that the response is correct (at least the setup / my src), but that RestEasy has any problems with that stuff ?? A few more eyes are highly appreciated on this "issue". thanks!! Matthias -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

On Wed, Jun 19, 2013 at 11:59 AM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: > Have you tried Resteasy mailing list? > that's next :-) I guess I wanted a second pair of eyes here :) > > Matthias Wessendorf wrote: > > Hi, > > > > trying to add CORS, to the Server (using RestEasy), I did this: > > > https://github.com/aerogear/aerogear-unified-push-server/commit/7ccb2e7fb > > > > (and some more variations.... (e.g. see the comment out > > "Access-Control-Allow-Origin", where I am returing the EXACT Origin)) > > > > > > Here is a JavaScript sample: > > http://jsfiddle.net/JY6n4/ > > > > > > Just click on the "Register a device" button, and see the errors in the > > console.... > > > > So, I am always (with the above jsFiddle) getting: > > Origin http://fiddle.jshell.net <http://fiddle.jshell.net/> is not > > allowed by Access-Control-Allow-Origin. > > > > regardless if I use "*" or "http://fiddle.jshell.net" (explicit > Origin), > > on the "Access-Control-Allow-Origin". I always thought that "*" is a > > wildcard.... allowing everybody and their mother to access the server. > > > > BTW. > > This happens with jQuery _and_ vanilla.js (XHR)..... So....... I am > > really overasked, but ... is it possible that the response is correct > > (at least the setup / my src), but that RestEasy has any problems with > > that stuff ?? > > > > > > A few more eyes are highly appreciated on this "issue". > > > > thanks!! > > Matthias > > > > > > -- > > Matthias Wessendorf > > > > blog: http://matthiaswessendorf.wordpress.com/ > > sessions: http://www.slideshare.net/mwessendorf > > twitter: http://twitter.com/mwessendorf > > > > _______________________________________________ > > aerogear-dev mailing list > > aerogear-dev(a)lists.jboss.org > > https://lists.jboss.org/mailman/listinfo/aerogear-dev > > -- > abstractj > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev > -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

On Wed, Jun 19, 2013 at 12:29 PM, Daniel Bevenius < daniel.bevenius(a)gmail.com&gt; wrote: > I noticed that you are not setting "Access-Control-Allow-Credentials". > I'm not sure what the underlying JS is setting .withCredentials on the > XMLHttpRequest object, but if it is then this request would fail. > tried with and without -> no difference > > > > > On 19 June 2013 12:03, Matthias Wessendorf <matzew(a)apache.org&gt; wrote: > >> >> >> >> On Wed, Jun 19, 2013 at 11:59 AM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: >> >>> Have you tried Resteasy mailing list? >>> >> >> that's next :-) >> >> I guess I wanted a second pair of eyes here :) >> >> >> >>> >>> Matthias Wessendorf wrote: >>> > Hi, >>> > >>> > trying to add CORS, to the Server (using RestEasy), I did this: >>> > >>> https://github.com/aerogear/aerogear-unified-push-server/commit/7ccb2e7fb >>> > >>> > (and some more variations.... (e.g. see the comment out >>> > "Access-Control-Allow-Origin", where I am returing the EXACT Origin)) >>> > >>> > >>> > Here is a JavaScript sample: >>> > http://jsfiddle.net/JY6n4/ >>> > >>> > >>> > Just click on the "Register a device" button, and see the errors in >>> the >>> > console.... >>> > >>> > So, I am always (with the above jsFiddle) getting: >>> > Origin http://fiddle.jshell.net <http://fiddle.jshell.net/> is not >>> > allowed by Access-Control-Allow-Origin. >>> > >>> > regardless if I use "*" or "http://fiddle.jshell.net" (explicit >>> Origin), >>> > on the "Access-Control-Allow-Origin". I always thought that "*" >>> is a >>> > wildcard.... allowing everybody and their mother to access the server. >>> > >>> > BTW. >>> > This happens with jQuery _and_ vanilla.js (XHR)..... So....... I am >>> > really overasked, but ... is it possible that the response is correct >>> > (at least the setup / my src), but that RestEasy has any problems with >>> > that stuff ?? >>> > >>> > >>> > A few more eyes are highly appreciated on this "issue". >>> > >>> > thanks!! >>> > Matthias >>> > >>> > >>> > -- >>> > Matthias Wessendorf >>> > >>> > blog: http://matthiaswessendorf.wordpress.com/ >>> > sessions: http://www.slideshare.net/mwessendorf >>> > twitter: http://twitter.com/mwessendorf >>> > >>> > _______________________________________________ >>> > aerogear-dev mailing list >>> > aerogear-dev(a)lists.jboss.org >>> > https://lists.jboss.org/mailman/listinfo/aerogear-dev >>> >>> -- >>> abstractj >>> >>> _______________________________________________ >>> aerogear-dev mailing list >>> aerogear-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>> >> >> >> >> -- >> Matthias Wessendorf >> >> blog: http://matthiaswessendorf.wordpress.com/ >> sessions: http://www.slideshare.net/mwessendorf >> twitter: http://twitter.com/mwessendorf >> >> _______________________________________________ >> aerogear-dev mailing list >> aerogear-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/aerogear-dev >> > > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev > -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

On Wed, Jun 19, 2013 at 12:47 PM, Daniel Bevenius < daniel.bevenius(a)gmail.com&gt; wrote: > When you tried that, did you specify the "Access-Control-Allow-Origin" to > be that of the "Origin" of the request > both versions, as said. https://github.com/aerogear/aerogear-unified-push-server/commit/7ccb2e7fb... that is commented out, and does not work as well > , or did you use the '*' wildcard? > It think it would fail unless you specify "*" ( > http://www.w3.org/TR/cors/#access-control-allow-credentials-response-header > ) > not sure what you are asking, but I tried both (separated) "*" and/or "request.getHeader("Origin")", which is the one from the incoming request see > > > > On 19 June 2013 12:32, Matthias Wessendorf <matzew(a)apache.org&gt; wrote: > >> >> >> >> On Wed, Jun 19, 2013 at 12:29 PM, Daniel Bevenius < >> daniel.bevenius(a)gmail.com&gt; wrote: >> >>> I noticed that you are not setting "Access-Control-Allow-Credentials". >>> I'm not sure what the underlying JS is setting .withCredentials on the >>> XMLHttpRequest object, but if it is then this request would fail. >>> >> >> >> tried with and without -> no difference >> >> >>> >>> >>> >>> >>> On 19 June 2013 12:03, Matthias Wessendorf <matzew(a)apache.org&gt; wrote: >>> >>>> >>>> >>>> >>>> On Wed, Jun 19, 2013 at 11:59 AM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: >>>> >>>>> Have you tried Resteasy mailing list? >>>>> >>>> >>>> that's next :-) >>>> >>>> I guess I wanted a second pair of eyes here :) >>>> >>>> >>>> >>>>> >>>>> Matthias Wessendorf wrote: >>>>> > Hi, >>>>> > >>>>> > trying to add CORS, to the Server (using RestEasy), I did this: >>>>> > >>>>> https://github.com/aerogear/aerogear-unified-push-server/commit/7ccb2e7fb >>>>> > >>>>> > (and some more variations.... (e.g. see the comment out >>>>> > "Access-Control-Allow-Origin", where I am returing the EXACT >>>>> Origin)) >>>>> > >>>>> > >>>>> > Here is a JavaScript sample: >>>>> > http://jsfiddle.net/JY6n4/ >>>>> > >>>>> > >>>>> > Just click on the "Register a device" button, and see the errors in >>>>> the >>>>> > console.... >>>>> > >>>>> > So, I am always (with the above jsFiddle) getting: >>>>> > Origin http://fiddle.jshell.net <http://fiddle.jshell.net/> is not >>>>> > allowed by Access-Control-Allow-Origin. >>>>> > >>>>> > regardless if I use "*" or "http://fiddle.jshell.net" (explicit >>>>> Origin), >>>>> > on the "Access-Control-Allow-Origin". I always thought that "*" >>>>> is a >>>>> > wildcard.... allowing everybody and their mother to access the >>>>> server. >>>>> > >>>>> > BTW. >>>>> > This happens with jQuery _and_ vanilla.js (XHR)..... So....... I am >>>>> > really overasked, but ... is it possible that the response is >>>>> correct >>>>> > (at least the setup / my src), but that RestEasy has any problems >>>>> with >>>>> > that stuff ?? >>>>> > >>>>> > >>>>> > A few more eyes are highly appreciated on this "issue". >>>>> > >>>>> > thanks!! >>>>> > Matthias >>>>> > >>>>> > >>>>> > -- >>>>> > Matthias Wessendorf >>>>> > >>>>> > blog: http://matthiaswessendorf.wordpress.com/ >>>>> > sessions: http://www.slideshare.net/mwessendorf >>>>> > twitter: http://twitter.com/mwessendorf >>>>> > >>>>> > _______________________________________________ >>>>> > aerogear-dev mailing list >>>>> > aerogear-dev(a)lists.jboss.org >>>>> > https://lists.jboss.org/mailman/listinfo/aerogear-dev >>>>> >>>>> -- >>>>> abstractj >>>>> >>>>> _______________________________________________ >>>>> aerogear-dev mailing list >>>>> aerogear-dev(a)lists.jboss.org >>>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>>>> >>>> >>>> >>>> >>>> -- >>>> Matthias Wessendorf >>>> >>>> blog: http://matthiaswessendorf.wordpress.com/ >>>> sessions: http://www.slideshare.net/mwessendorf >>>> twitter: http://twitter.com/mwessendorf >>>> >>>> _______________________________________________ >>>> aerogear-dev mailing list >>>> aerogear-dev(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>>> >>> >>> >>> _______________________________________________ >>> aerogear-dev mailing list >>> aerogear-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>> >> >> >> >> -- >> Matthias Wessendorf >> >> blog: http://matthiaswessendorf.wordpress.com/ >> sessions: http://www.slideshare.net/mwessendorf >> twitter: http://twitter.com/mwessendorf >> >> _______________________________________________ >> aerogear-dev mailing list >> aerogear-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/aerogear-dev >> > > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev > -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf

** Hi, The OPTIONS request method which handles the preflight request is correct but CORS headers should be added at the POST method response headers as well. I've performed the below changes and it worked. The changes are marked with bold. In addition change the clientIdentifier to alias in the request body. *private Response makeCORS(ResponseBuilder rb) {* * rb.header("Access-Control-Allow-Origin", "*")* * .header("Access-Control-Allow-Methods", "GET, POST, OPTIONS, PUT, DELETE")* * .header("Access-Control-Allow-Headers", "accept, origin, ag-mobile-variant, content-type");* * * * return rb.build();* *}* @POST @Consumes(MediaType.APPLICATION_JSON) public Response registerInstallation( MobileVariantInstanceImpl entity, @Context HttpServletRequest request) { ... return *makeCORS*(Response.ok(*"[]"*)); } On Wed, 2013-06-19 at 11:52 +0200, Matthias Wessendorf wrote: Hi, trying to add CORS, to the Server (using RestEasy), I did this: https://github.com/aerogear/aerogear-unified-push-server/commit/7ccb2e7fb (and some more variations.... (e.g. see the comment out "Access-Control-Allow-Origin", where I am returing the EXACT Origin)) Here is a JavaScript sample: http://jsfiddle.net/JY6n4/ Just click on the "Register a device" button, and see the errors in the console.... So, I am always (with the above jsFiddle) getting: Origin http://fiddle.jshell.net is not allowed by Access-Control-Allow-Origin. regardless if I use "*" or "http://fiddle.jshell.net" (explicit Origin), on the "Access-Control-Allow-Origin". I always thought that "*" is a wildcard.... allowing everybody and their mother to access the server. BTW. This happens with jQuery _and_ vanilla.js (XHR)..... So....... I am really overasked, but ... is it possible that the response is correct (at least the setup / my src), but that RestEasy has any problems with that stuff ?? A few more eyes are highly appreciated on this "issue". thanks!! Matthias _______________________________________________ aerogear-dev mailing listaerogear-dev@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/aerogear-dev _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev