Question

On domain A (localhost:8080) I run this code to access an unauthenticating REST serivce on domain B (localhost):

req = new XMLHttpRequest();
req.open('GET', 'http://localhost/rest/service');
req.send();

This works fine and I do get my response across domains as I have Apache on domain B set the response header:

Header set Access-Control-Allow-Origin "http://localhost:8080"

However if I now turn on authentication for the REST service and try to run the same request:

req.open('GET', 'http://admin:admin@localhost/rest/service');

It now produces this error in Firebug:

Access to restricted URI denied" code: "1012

I’m confused that I am able to sucessfully make cross domain ajax calls to the authenticated service bypassing the same origin policy, yet when authentication is required on the service Firefox decides not to allow the ajax call? How can I fix this without using jsonp etc, as the production server won’t be able to provide PHP or Servlet hosting.

Answer 1

It’s easy with JQuery 1.5+, which I recommend you use for your JavaScript solution:

$.ajax({
    url: 'http://admin:admin@localhost/rest/service',
    crossDomain:true, // Here is the JSONP callback logic 
    success: function(data){
        console.log(data); // data is what comes back from your remote file
    }
});