CORS issue ArcGIS 10.1 IIS (Cross Origin Resource Sharing)

Question

I have ArcGIS 10.1 installed with the web adapter for IIS. I've added a config file to the root of IIS7 to enable Cross Origin Resource Sharing (CORS) as per this page. I've pushed the cors enabled ArcGIS server into the list of default cors servers as per this page:

esri.config.defaults.io.corsEnabledServers.push("vmagstenone")). 

However, when my JavaScript application which is hosted on vmagsten makes a request to the GIS server (vmagstenone) I get the error

"Origin http://vmagsten is not allowed by Access-Control-Allow-Origin.". 

Edit: And the feature layer fails to load. I have also tried loading a dynamic layer and this too fails with the same error _557 (see image)

Edit: I should not be seeing this error as the above steps should mean that the server does support cross origin. This statement by esri that this error can be ignored does not apply in this case since this server should support cors. It does mean that the first error to the ESRI server can be ignored.

!

Edit: here is a sample response from a query on this layer showing that the response has Access-Control-Allow-Origin

!

Answer 1

You mention you get the error, but does the service actually fail to load?

I ask, as I spotted this post on the Esri forums which states:

This error can safely be ignored. There are cases where the API will not send a request to //rest/info and are as follows: The browser does not support CORS The Server is already listed in esri.config.defaults.io.corsEnabledServers esri.config.defaults.io.corsDetection is false JSON is used instead of JSONP in the following cases: The resource being fetched is on the same domain as the application The resource being fetched is on a server that supports CORS

Im assuming it happens in other browser consoles as well?

If not, can you throw a Fiddler log or .HAR file online somewhere (or email me it), and ill edit this answer accordingly.

Answer 2

While the response does contain an Access-Control-Allow-Origin: * header, it also contains X-Frame-Options: SAMEORIGIN and X-XSS-Protection: 1; mode=block headers. These are X-prefix headers, which are non-standard, so I'm not 100% sure if your browser is honoring them over the allow header.

You can use a tool like Fiddler to add and remove headers from browser requests; this might help you track down what is happening.

Answer 3

Here's what worked for me in IIS 8.0. This may be different on other versions of IIS.

Either remove the customHeaders in the website root directory's web.config file or delete the web.config file completely.

Then switch to the ApplicationHost.config in the IIS Configuration Manager for the arcgis application and add Access-Control-Allow-Origin name and * value to the customHeaders.

Answer 4

I am not familiar with the cross-origin resources sharing.
I use the cross-domain policy.

Do you have that configured as well?

Answer 5

What finally worked for me is adding the following to the ROOT site and NOT the application for the web adapter. Does it make sense? Not to me. But it worked for me.

EDIT: This should go in the DotNet proxy file called Web.config.

<configuration>
  <...rest of file...>
    <system.webServer>
      <httpProtocol>
       <customHeaders>
         <add name="Access-Control-Allow-Origin" value="*" />
       </customHeaders>
      </httpProtocol>
    </system.webServer>
  </...rest of file...>
</configuration>