CORS Firewall problems

Question

I have a Angularjs Web Application hosted at www.foo.com and its Web api at www.api.foo.com . I have enabled CORS at the server side. It all works well.But CORS Access-Control-Allow-Origin header is getting stripped at corporate netwoks (firewalls such as Watchdog does this by default link ). My website is a public site. Any Suggestions to solve this issue. Everywhere JSONP is suggested, but I will need to do posts as well.

Answer 1

You could avoid calling api.foo.com directly from angular and instead use foo.com as a proxy to api.foo.com. It's a known technique so you can find the details online. The downside is that you have to take care of two requests, a normal frontend-backend ajax request, and a server-server call (foo.com -> api.foo.com).

Since you have an Angular application, you'd also need to exclude a part of the URL from the SPA. Something like foo.com/api/* can't be redirected to the index.html where the app is initialized. Otherwise all your requests will fail.