cross domain posts to ASP.Net MVC app

Question

I'm developing an app where HTML and javascript chunks are delivered down to different clients. I'm able to GET the html/javascript chunks by adding the following to web config file:

  <system.webServer>
<modules runAllManagedModulesForAllRequests="true" />
  <httpProtocol>
      <customHeaders>
          <add name="Access-Control-Allow-Origin" value="*" />
          <add name="Access-Control-Allow-Headers" value="Content-Type" />
          <add name="Access-Control-Allow-Methods" value="POST, GET, OPTIONS" />
      </customHeaders>
  </httpProtocol>

This is working great for doing GETS. The problem I'm running into is doing POSTs cross domain using jQuery:

        $.ajax(
    {
        type: 'POST',
        url: url,
        crossDomain: true,
        data: JSON.stringify(data),
        dataType: 'json',
        contentType: 'application/json',
        success: function(responseData, textStatus, jqXHR) 
        {
            alert('Success');
        },
        error: function (responseData, textStatus, errorThrown) 
        {
            alert('POST failed.');
        }
    });

I will have numerous clients consuming my app (hopefully). I thought about using a proxy, but I do not have control of the client servers so I'm not able to install a httpHandler to act as a proxy.

Any suggestions on how I can POST json data from different clients cross domain to my ASP.Net MVC app?

Answer 1

I fiddled with my ajax call and it seems to be working (compare to the ajax call above):

        $.ajax(
    {
        type: 'POST',
        url: url,
        crossDomain: true,
        data: data,
        dataType: 'json',
        success: function(responseData, textStatus, jqXHR) 
        {
            alert('success');
        },
        error: function (responseData, textStatus, errorThrown) 
        {
            alert('POST failed.');
        }
    });

I removed "contentType: 'application/json'" and "JSON.stringify(...)" calls and I'm able to post to the server.

I'm not sure how to explain why it's working. Any ideas? Are there any security issues? I'm doing this all on my laptop. I set up 2 different websites via IIS 7. Will this make a difference?

Answer 2

Internally the JSONP response (the default type for cross-domain requests) is fetched by injecting a <script> tag, which points to the URL. Because of that, only GET method is possible with JSONP. Other methods will be ignored and fall back to GET.