AngularJS trying to do CORS

Question

I have a Ruby On rails Json API. I also have an AngularJS frontend and I am making CORS requests.

Everything works ok when I return 200 (for example on posts it's actually calling OPTIONS method and getting cors headers for the server). But when I return 401 (unauthorized) I get a Cross site error. I want to handle this error and show an appropiate message (when the user is not authorized to execute a method) but it seems that 401 response fires CORS error.

Any help?

Could you add the code snippet showing how you are currently making these requests using AngularJS? — SirTophamHatt
– SirTophamHatt, Commented Nov 22, 2013 at 18:45

monsur · Accepted Answer · 2013-11-23 20:35:07Z

2

CORS is independent of authentication. Your should layer your CORS response on top of your actual response. So in the case of an authentication error, here's how you should respond:

The preflight response (e.g. the response to the OPTIONS request) should always return HTTP 200, along with the appropriate CORS headers: Access-Control-Allow-Origin, Access-Control-Allow-Methods and Access-Control-Allow-Headers (if necessary). There should be no body on the preflight response.
The actual response should respond with 401, if there is an auth error. But it should still have the CORS headers, e.g. Access-Control-Allow-Origin etc.

This tells the browser that the cross-origin request was successful, but there was an underlying issue with the request (e.g. the auth error).

edited Nov 23, 2013 at 20:35

answered Nov 22, 2013 at 17:42

monsur

48.3k19 gold badges104 silver badges96 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Tony Over a year ago

what does it mean that it is "orthogonal"

monsur Over a year ago

"Orthogonal" means "independent". I updated the text.

Collectives™ on Stack Overflow

AngularJS trying to do CORS

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related