Question

I have a site written in Delphi that needs to get data from a .NET web service. In order to consume the web service I am attaching to a .NET web site first that contains a wizard that the end user has to fill out, which in turn is then calling the web service in order to populate AJAX drop-down lists and to return data to the calling Delphi web application.

So, to be clear …

1. Delphi web site opens .NET web site
2. .NET web site populates AJAX drop down lists from .NET web service
3. When user clicks submit on the .NET web wizard it calls .NET web service to get data and returns to Delphi web site

However calling the .NET web service to populate the drop downs causes IE6 (and indeed all browsers) to treat this as a cross domain security threat and I get the “This page is accessing information that is not under its control. This poses a security risk …” error.

The code for the drop downs is as follows (in case this helps) …

In .apsx file

<asp:DropDownList ID="DocCategoryDropDown" 
              runat="server" 
              OnSelectedIndexChanged="DocCategoryDropDown_SelectedIndexChanged"
              AutoPostBack="true">
</asp:DropDownList>
<ajaxToolkit:CascadingDropDown ID="DocCategoryCascadingDropDown" 
                           runat="server" 
                           TargetControlID="DocCategoryDropDown"
                           LoadingText="[Loading...]" 
                           Category="CategoryId" 
                           UseContextKey="True" 
                           ContextKey="NY"
                           PromptText="Select a Category" 
                           ServiceMethod="GetDocCategory" 
                           ServicePath="tba">
</ajaxToolkit:CascadingDropDown>

in C# file

DocCategoryCascadingDropDown.ServicePath = path;

If path is on the same server as the web site it works fine but if path is not I get the warning, therefore it must be a cross domain security issue.

I’ve had similar issues with Java web services before and I got around this by using proxying on Apache in order to make the web site that hosts the wizard and the web service appear to exist on the same domain, and therefore stop the errors.

Can anyone tell me how I can do this same thing in IIS, please?

If there is any more information I can supply, please let me know as I’d really like to get this issue resolved as soon as I can.

Many thanks in advance.

Answer 1

OK, after much googling (and gnashing of teeth) I found this website that does a good job of explaining the solution.

http://dotnetslackers.com/columns/ajax/MashitUpwithASPNETAJAX.aspx

Just goes to show how important it is to know how to ask the right question 🙂