topic alfresco enable cross origin resource sharing in Alfresco Archive

alfresco enable cross origin resource sharing

hdalang — Fri, 20 Feb 2015 11:29:19 GMT

I tried to use this form to communicate with alfresco but it's not working and it gave me the following error:XMLHttpRequest cannot load http://localhost:8085/alfresco/service/hello. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed

Re: alfresco enable cross origin resource sharing

mrogers — Fri, 20 Feb 2015 11:58:20 GMT

The problem is that pulling in resources from multiple web servers is a common way to inject malware into a web page a so called XSS attack. So alfresco has turned on web page options to prevent you being able to load resources from external sources.

I see you are trying to load
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.7/jquery.js"></script>
<script src="http://malsup.github.com/jquery.form.js"></script>

You need to load those resources from alfresco or via Share's proxy.

Re: alfresco enable cross origin resource sharing

mathias_lin — Thu, 13 Aug 2015 13:01:39 GMT

Would enabling the CORS filter in the web.xml and setting

      <init-param>
         <param-name>cors.allowOrigin</param-name>
         <param-value>*</param-value>
      </init-param>

not work in his case?

I have a similar issue, but it's a bit weirder in my case. Some Alfresco API urls allow cross-domain access, some don't. My recent issue on StackOverflow (see especially "Update 2"):
http://stackoverflow.com/questions/31981648/angularjs-alfresco-cors-filter-issue-no-access-control-allow-origin-hea

Re: alfresco enable cross origin resource sharing

golla77 — Tue, 08 Mar 2016 17:00:11 GMT

Hi All,

I am trying to upload document use Alfresco REST service (http://localhost:9090/alfresco/service/api/upload) using Ajax script. and the file is successfully uploading into alfresco but getting below error with no response header. we are expecting in the response status and nodeRef. but response is empty. need help how to solve this.

Error:

XMLHttpRequest cannot load http://amxbpmdnsname:9090/alfresco/service/api/upload. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:8888'' is therefore not allowed access.

===========================

Ajax script:

$.support.cors = true;
   $.ajax({
      type: "POST",
      url: "http://localhost:9090/alfresco/service/api/upload",
      data: data,
      headers: {Authorization: make_base_auth('xxx', 'xxxxx')},
      contentType: false,
      processData: false,
      success: uploadSuccess,
      error:UploadError,
      //complete: completProcess
   });

===========================

web.xml

<filter-mapping>
      <filter-name>CORS</filter-name>
    <!– <url-pattern>/*</url-pattern> –>
      <url-pattern>/api/*</url-pattern>
      <url-pattern>/service/*</url-pattern>
      <url-pattern>/s/*</url-pattern>
      <url-pattern>/cmisbrowser/*</url-pattern>
   </filter-mapping>

===============

<filter>
      <filter-name>CORS</filter-name>
      <filter-class>com.thetransactioncompany.cors.CORSFilter</filter-class>
      <init-param>
         <param-name>cors.allowGenericHttpRequests</param-name>
         <param-value>true</param-value>
      </init-param>
      <init-param>
         <param-name>cors.allowOrigin</param-name>

       <!– <param-value>http://localhost:8888</param-value> –>

        <param-value>*</param-value>
      </init-param>
      <init-param>
         <param-name>cors.allowSubdomains</param-name>
         <param-value>true</param-value>
      </init-param>
      <init-param>
         <param-name>cors.supportedMethods</param-name>
         <param-value>GET, HEAD, POST, PUT, DELETE, OPTIONS</param-value>
      </init-param>
      <init-param>
         <param-name>cors.supportedHeaders</param-name>
         <param-value>origin, authorization, x-file-size, x-file-name, content-type, accept, x-file-type</param-value>
      </init-param>
     <!– <init-param>
         <param-name>cors.exposedHeaders</param-name>
         <param-value>*</param-value>
      </init-param>
     –>
      <init-param>
         <param-name>cors.supportsCredentials</param-name>
         <param-value>true</param-value>
      </init-param>
      <init-param>
         <param-name>cors.maxAge</param-name>
         <param-value>3600</param-value>
      </init-param>
   </filter>