Re: CORS header 'Access-Control-Allow-Origin'

[Scott Klement <web400@xxxxxxxxxxxxxxxx>]

What did I do?   I added the 'access-control-allow-origin' header.

On 4/5/19 1:55 PM, Booth Martin wrote:
> Security issues scare me.  It seems like a really easy place to make 
> oneself look like an idiot.
>
> Here is the scenario:  I have a web services service available. It is 
> reachable over the internet (if one is inside the VPN) from a browser 
> line at, say, _http://an.ibm.i/api/dayName/2019-03-15_ and returns:
>
> dayOut     "2019-03-15 is a Friday"
>
> which is what I expect and want.
>
> However if I use that link in an index.html on the same desktop I get  
> "Cross-Origin Request Blocked: The Same Origin Policy disallows 
> reading the remote resource at http://.../api/dayName/2019-03-15. 
> (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
>
> OK.  I get it.  There is a security issue that is being solved. Good.
>
> So I read about what to do and realize this is way out of my 
> wheelhouse.  What have others done?