webapi and silly cross site scripting stuff

[reven]

hi sub,

could you please add the header

Response.AppendHeader("Access-Control-Allow-Origin", "*");

to all responses for the web api? im trying to get chrome talking to the server, but since its running on a different domain (localhost vs my nextpvr), its blocked because that header isnt present.

also any chance you could send me a dll with the change?

thanks,

ps happy new year

[sub]

The attached adds that header, but make sure you backup your original file first - I've started to make changes for the next release, and it may not be compatible with the rest of the build. You might be lucky with this specific file though.

[reven]

quick test and that appears to have fixed it, even if i come across some issues with it because of other changes, i can confirm the header fix does fix the silly xss issue (that thing always annoys me).

thanks sub

[reven]

hi sub can you also do the same to all webapi calls?

I'm getting the same error on the service?method=session.initiate function when running on google tv.

and can you please provide me a build with the change?

thanks

[sub]

hi sub can you also do the same to all webapi calls?

It should already be the same on all of the service?method=... web api calls.

I'm getting the same error on the service?method=session.initiate function when running on google tv.

I just checked this specific call, and it is definitely returning that header.

Are you sure you're not seeing it?

[reven]

you're right, it is returning that header... for some reason google tv is complaining about it still... thanks ill check it out.

[reven]

got it to work, had to set a flag on the webview to allow this header, very odd. thanks sub.