Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

I have ArcGIS 10.1 installed with the web adapter for IIS. I've added a config file to the root of IIS7 to enable Cross Origin Resource Sharing (CORS) as per this page. I've pushed the cors enabled ArcGIS server into the list of default cors servers as per this page:

esri.config.defaults.io.corsEnabledServers.push("vmagstenone")). 

However, when my JavaScript application which is hosted on vmagsten makes a request to the GIS server (vmagstenone) I get the error

"Origin http://vmagsten is not allowed by Access-Control-Allow-Origin.". 

Edit: And the feature layer fails to load. I have also tried loading a dynamic layer and this too fails with the same error _557 (see image)

Edit: I should not be seeing this error as the above steps should mean that the server does support cross origin. This statement by esri that this error can be ignored does not apply in this case since this server should support cors. It does mean that the first error to the ESRI server can be ignored.

enter image description here!

Edit: here is a sample response from a query on this layer showing that the response has Access-Control-Allow-Origin

enter image description here!

share|improve this question
2  
You may want to define CORS, so that it is clear we are talking about Cross Origin Resource Sharing and not a Continuously Operating Reference Station, which is used for GPS. –  Kirk Kuykendall Apr 9 '13 at 15:21
2  
Have you made sure that your IIS is returning the required Headers for CORS? –  Devdatta Tengshe Apr 9 '13 at 15:33
    
@DevdattaTengshe I've edited the post above –  David Wilton Apr 9 '13 at 15:50
add comment

3 Answers

You mention you get the error, but does the service actually fail to load?

I ask, as I spotted this post on the Esri forums which states:

This error can safely be ignored. There are cases where the API will not send a request to //rest/info and are as follows: The browser does not support CORS The Server is already listed in esri.config.defaults.io.corsEnabledServers esri.config.defaults.io.corsDetection is false JSON is used instead of JSONP in the following cases: The resource being fetched is on the same domain as the application The resource being fetched is on a server that supports CORS

Im assuming it happens in other browser consoles as well?

If not, can you throw a Fiddler log or .HAR file online somewhere (or email me it), and ill edit this answer accordingly.

share|improve this answer
    
Sorry I should have mentioned I did see that. The service does fail to load. I will post the error from Firefox. It does not fail in IE –  David Wilton Apr 10 '13 at 6:51
    
I think you are probably right that the first two errors should be ignored as ESRI say these are expected. However, the error _557 coming from the framework seems to be the issue. I get the same error in version 3.3 & 3.4 –  David Wilton Apr 10 '13 at 8:08
    
I've also tried using a dynamic layer rather than a feature layer and that has the same issue. If the site is hosted on the same server as the data there are no errors. Using chrome.exe --disable-web-security (do not enforce cors policy) the requests are fine. This is what leads me to believe it is an issue with coors and the request. –  David Wilton Apr 10 '13 at 8:33
add comment

While the response does contain an Access-Control-Allow-Origin: * header, it also contains X-Frame-Options: SAMEORIGIN and X-XSS-Protection: 1; mode=block headers. These are X-prefix headers, which are non-standard, so I'm not 100% sure if your browser is honoring them over the allow header.

You can use a tool like Fiddler to add and remove headers from browser requests; this might help you track down what is happening.

share|improve this answer
add comment

I am not familiar with the cross-origin resources sharing.
I use the cross-domain policy.
cross domain policy
Do you have that configured as well?

share|improve this answer
1  
Yes I have both the crossdomain.xml clientaccesspolicy.xml files as configured by the ArcGIS server install. However, it is my understanding that these files relate to Flex and silverlight applications (link). I will edit question to make it clear that I am talking about JS only resources.arcgis.com/en/help/install-guides/arcgis-server/10.1/… –  David Wilton Apr 9 '13 at 14:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.