I have ArcGIS 10.1 installed with the web adapter for IIS. I've added a config file to the root of IIS7 to enable Cross Origin Resource Sharing (CORS) as per this page. I've pushed the cors enabled ArcGIS server into the list of default cors servers as per this page:


However, when my JavaScript application which is hosted on vmagsten makes a request to the GIS server (vmagstenone) I get the error

"Origin http://vmagsten is not allowed by Access-Control-Allow-Origin.". 

Edit: And the feature layer fails to load. I have also tried loading a dynamic layer and this too fails with the same error _557 (see image)

Edit: I should not be seeing this error as the above steps should mean that the server does support cross origin. This statement by esri that this error can be ignored does not apply in this case since this server should support cors. It does mean that the first error to the ESRI server can be ignored.

enter image description here!

Edit: here is a sample response from a query on this layer showing that the response has Access-Control-Allow-Origin

enter image description here!


5 Answers 5


You mention you get the error, but does the service actually fail to load?

I ask, as I spotted this post on the Esri forums which states:

This error can safely be ignored. There are cases where the API will not send a request to //rest/info and are as follows: The browser does not support CORS The Server is already listed in esri.config.defaults.io.corsEnabledServers esri.config.defaults.io.corsDetection is false JSON is used instead of JSONP in the following cases: The resource being fetched is on the same domain as the application The resource being fetched is on a server that supports CORS

Im assuming it happens in other browser consoles as well?

If not, can you throw a Fiddler log or .HAR file online somewhere (or email me it), and ill edit this answer accordingly.

  • Sorry I should have mentioned I did see that. The service does fail to load. I will post the error from Firefox. It does not fail in IE Commented Apr 10, 2013 at 6:51
  • I think you are probably right that the first two errors should be ignored as ESRI say these are expected. However, the error _557 coming from the framework seems to be the issue. I get the same error in version 3.3 & 3.4 Commented Apr 10, 2013 at 8:08
  • 1
    I've also tried using a dynamic layer rather than a feature layer and that has the same issue. If the site is hosted on the same server as the data there are no errors. Using chrome.exe --disable-web-security (do not enforce cors policy) the requests are fine. This is what leads me to believe it is an issue with coors and the request. Commented Apr 10, 2013 at 8:33

While the response does contain an Access-Control-Allow-Origin: * header, it also contains X-Frame-Options: SAMEORIGIN and X-XSS-Protection: 1; mode=block headers. These are X-prefix headers, which are non-standard, so I'm not 100% sure if your browser is honoring them over the allow header.

You can use a tool like Fiddler to add and remove headers from browser requests; this might help you track down what is happening.


Here's what worked for me in IIS 8.0. This may be different on other versions of IIS.

Either remove the customHeaders in the website root directory's web.config file or delete the web.config file completely.

Then switch to the ApplicationHost.config in the IIS Configuration Manager for the arcgis application and add Access-Control-Allow-Origin name and * value to the customHeaders.

IIS 8.0 Configuration Editor



I am not familiar with the cross-origin resources sharing.
I use the cross-domain policy.
cross domain policy
Do you have that configured as well?

  • 1
    Yes I have both the crossdomain.xml clientaccesspolicy.xml files as configured by the ArcGIS server install. However, it is my understanding that these files relate to Flex and silverlight applications (link). I will edit question to make it clear that I am talking about JS only resources.arcgis.com/en/help/install-guides/arcgis-server/10.1/… Commented Apr 9, 2013 at 14:18

What finally worked for me is adding the following to the ROOT site and NOT the application for the web adapter. Does it make sense? Not to me. But it worked for me.

EDIT: This should go in the DotNet proxy file called Web.config.

  <...rest of file...>
         <add name="Access-Control-Allow-Origin" value="*" />
  </...rest of file...>

enter image description here

  • THIS was the answer that worked for me... I'm editing your answer so as to clarify what needs to be adjusted. Commented Oct 4, 2016 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.