AJAX'ing blob to another domain via CORS

Question

Can anyone tell me why this request is failing to get past the SO policy restriction?

JS:

var blob = new Blob([req.response], {type: "application/octet-stream"});
req = new XMLHttpRequest();
req.open("POST", ws_path(other_context, 'receive_pkg'), true);
req.onload = function (evt) { alert(req.response); };
req.send(blob);

The called PHP page on the other domain:

header('Access-Control-Allow-Origin: *');
file_put_contents('log.txt', 'script accessed');

The request does go, and the log is written, but the browser blocks the response. I have another request to the same script that is NOT a blob, but a normal post request, and this responds just fine. The problem seems to be with just the blob request, and I've no idea why or whether what I'm doing is actually prohibited.

[Research effort: I got my hopes up when I found this question, but duplicate answers deal only with CORS in general, not blobs, as per the OP's question]

Mitya · Accepted Answer · 2014-11-29 13:29:38Z

1

After a lot of digging and experimentation with this I found a workaround: namely, change the encoding from application/octet-stream to application/x-www-form-urlencoded.

With the former, the request is blocked, even though the web service called explicitly allows the caller domain for CORS. With the latter, the caller domain is allowed through.

However, this brings a new problem: data sent in this way, at least to a PHP web service, will likely exceed the max_input_vars stat.

This can be overcome by increasing it, via a .htaccess file, like so:

php_value max_input_vars 50000000

answered Nov 29, 2014 at 13:29

Mitya

34.8k15 gold badges70 silver badges126 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

code_monk Over a year ago

This article on MDN explains why. TL;DR: For non-standard encodings, you have to use a preflight CORS request, not a simple one. The biggest caveat is that you cannot do Access-Control-Allow-Origin: * with those

Mitya Over a year ago

Aha so it's documented, and not a bug, then. Thanks for the tip.

Collectives™ on Stack Overflow

AJAX'ing blob to another domain via CORS

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related