Actually, that INCLUDE is wrong. Should be:
RESPONSE.HEADER=""RESPONSE.HEADER<1> ="Access-Control-Allow-Origin"RESPONSE.HEADER<2> = "*"RESPONSE.HEADER<1,2> = "ACCESS_CONTROL_ALLOW_CREDENTIALS_HEADER"RESPONSE.HEADER<2,2> = "true"CALL MVSP.SET.HTTP.RESPONSE.HEADER(RESPONSE.HEADER)
And it won't help with Toolkit versions prior to 2.2.3.122. Better to change the webservices_configuration.xml file. Find:
<instance id="http-cross-origin-resource-sharing">
And just below it find this:
<property name="enabled" value="false"/>
Change "false" to "true" and restart the MVS Toolkit service:
Windows: In services, "Rocket MV Web Service"
Linux: systemctl stop mv.serv then systemctl start mv.serv
------------------------------
Brian S. Cram
Principal Technical Support Engineer
Rocket Software
------------------------------
Original Message:
Sent: 09-17-2021 18:56
From: Fausto Paredes
Subject: CORS
Hey Chris
You could do the following at the beginning of your programs, put an Include with the following information.
CORS_headers
RESPONSE.HEADER=""
RESPONSE.HEADER<1> ="Access-Control-Allow-Origin"
RESPONSE.HEADER<2> = "*"
RESPONSE.HEADER<3> = "ACCESS_CONTROL_ALLOW_CREDENTIALS_HEADER"
RESPONSE.HEADER<4> = "true"
CALL MVSP.SET.HTTP.RESPONSE.HEADER(RESPONSE.HEADER)
EXAMPLE:
SUBROUTINE LIST_TASK(InArg)
INCLUDE CORS_headers
Whatever...
RETURN
I hope information this helps your question.
Regards
------------------------------
Fausto Paredes
GENERAL MANAGER
Admindysad Cia. Ltda.
Quito Ecuador
Original Message:
Sent: 09-16-2021 08:59
From: Chris Wolcz
Subject: CORS
I am trying to demo the MVS Toolkit to a prospect. I wrote an HTML page (java script gets the data from the MVS Toolkit and displays it) to avoid the need to install a web server somewhere. I have hit the Cross-Origin Request (CORS) problem. I found some documentation how to enable this on MVS Toolkit. It says there: "Access-Control-Allow-Origin contains a list of domains (separated by either an asterisk (*) or a comma) that are allowed access to web services hosted on the MVS server. If all client domains are allowed access, set this value to *. Otherwise, enter a comma separated list of domains." I think, setting this to * is less than perfect, but what is my domain if the webpage resides on my hard-drive not on the web server?
------------------------------
Chris Wolcz
Senior Software Developer
Execontrol Global Solutions
Clifton Park NY United States
------------------------------