Rest api returns error 403 while calling from Wordpress but works in postman - wordpress

I have one server on which Apache and Tomcat both are installed to run my Wordpress and Java application respectively. Both are on same ip address and using same domain https://www.example.com only port number is different.
Wordpress is running on default port while Tomcat is runing on 8443.
A rest api on Tomcat https://www.example.com:8443/myApi.html is working fine from postman, but when calling from wordpress using ajax, it returns error 403 forbidden response.
I am stuck on searching its solution but failed.
Please help me out to solve this issue.
Thanks

You cannot use a different port, even when using the same domain. This breaks the Same origin policy.You can however use JSONP if you have access to both the daemon and the requesting site. If data needs to be returned, then the daemon needs to support a callback query parameter and return it properly formatted.
please see 1) https://stackoverflow.com/a/2099771
https://stackoverflow.com/a/2099784

Related

Diagnosing an additional redirect in a "Request initiator chain" when moving from localhost to a hosted site

I'm in the process of deploying my React site to AWS via Amplify, and the first step on the site is authenticating with Spotify. Here in their auth guide, they call the type of auth I am performing "Authorization Code Flow" where the first step is the site requesting a scoped auth and receiving a code via a http redirect.
This all works fine and dandy when I am running the app locally - the network logs and associated looks like this (apologies, I'm not sure how to best reproduce for you this devtools output):
localhost network logs
localhost initiator chain
But when I attempt this on my live site soundfound.io I instead receive in additional redirect which makes it impossible for me to retrieve the code (I believe at least - I could not figure out a workaround where I just capture the code from the 2nd 302 here but if you do, please enlighten me b/c I'm at the end of my rope here).
live network logs
localhost initiator chain
and here - my boilerplate AWS Amplify domain config: https://ibb.co/SV1N809
I've been reading up but this is just not clicking with me - WHO or WHAT is causing this additional redirect? It's certainly not the React application itself, that doesn't make any sense. Spotify knows about both redirect urls (localhost:3000/redirect and soundfound.io/redirect) so I don't understand how that could behave differently. The only place I can think to look is within the domain registration and control part of AWS Amplify - but I don't see (or don't understand) anything that would cause this sort of issue?
I'm just so lost as to where to begin trying to troubleshoot this, any and all help would be appreciated. Thanks
The AWS Amplify automatically creates a rule in the console App settings under "Rewrites and redirects" that redirects all requests to my base domain "soundfound.io" to "www.soundfound.io". Erasing this rule solved the issue.

Swagger UI - TypeError: Failed to fetch - on endpoint request (ASPNET Core API)

When trying to run a request through swagger UI, I receive the following response on Swagger
TypeError: Failed to fetch
After searching around, I found that a possible cause of this error is because of a CORS issue, where the origin is changed in the request (as you can see at this other post here). However, in my case, this is not running through some other proxy, it is hosted on a locally hosted server and that server is not changing any of the headers. I realized this when I tried to allow the API to just accept any CORS headers to test if this was the issue; sadly it was not and the issue persisted.
The API is running on IIS hosted on a server that is hosted locally. The API is running as an application on the default website and is accessed via the following url:
http://servername/application-name/swagger/index.html
Can anyone help with this issue?
After further investigation, I found that when I looked at the requests being sent to the server through the dev tools on the browser, that the URL was being changed from http to https on the request of the endpoint through swagger.
HTTPS, has not been set up on the server and returns a 404 (as seen in the dev tools).
It turns out, that even though the server has not been setup to serve content via HTTPS, the requests where still redirected to HTTPS and this was the reason
app.UseHttpsRedirection();
So, even though swagger was able to be loaded on HTTP, when the request was made to the API, the API responded with a 307 - for redirection and the request was redirected to HTTPS - which in turn returned 404. This 404 response was the cause the TypeError: Failed to fetch
The recommended fix for this is to turn off https redirection (ONLY FOR TESTING PURPOSES) and the other is to enable the server to serve the content correctly over HTTPS, so that when a call is made, it is not redirected, but rather sent straight to the correct API address on HTTPS - which should not return the data correctly, since the server can serve HTTPS content

Access-Control-Allow-Origin and CORS problems with WordPress APIs

I'm getting a error Access-Control-Allow-Origin when attempting to use Vue.js and axios to get data from the WordPress APIs.
I'm using OpenLiteSpeed on digital ocean to host a headless WordPress APIs. Today I had to restart the server to update my security certificate. After restart, I started getting an error with my axios get request, but only when I use the base URL, not www.
For example, if you go to www.samiamido.com everything works fine. But if you go to just samiamido.com there is a CORS related error. I don't think that this happened before I updated the cert this morning.
I created a simple test site on my local machine and got the same error.
I don't remember ever setting www.samiamido.com as a response header, or even where I would have done that at (openlitespeed console, wp-admin, or whatever).
Anyone now where to even start to debug? Getting very frustrated at this point!

Ngrok not working correctly

I've installed ngrok in Win 10 on a VM but I don't think it's working correctly.
To start it up and I use this command below to run it
ngrok http -host-header="localhost:44368" 44368
and it looks like ngrok starts up ok, but when I put the https url given by ngrok into a browser this is what I see
Shouldn't I see something?
and in the ngrok console I see the get requests but no response times or response messages
same with the localhost:4040 page and every get request has a 0ms response time
I had the same issue running an ASP.NET Core MVC Server.
Upon lots of investigation, disabling the https url of my server seemed to work.
So essentially forcing it to only use http.
I had the problem using both http and https ngrok urls.
So for my ASP.NET core project in the launchSettings.json, ensure you only have the http option, remove the https url under your desired launch profile:
"applicationUrl": "http://localhost:5001;"
If it is still not works for you after #MikeDub's fix, please try this.
Go to properties of your startup project (api project) and untick,
Enable SSL
in Debug section.
As MikeDub mentioned above, I also found the exact explanation on Twilio documentation here:
https://www.twilio.com/docs/sms/quickstart/csharp-dotnet-core#allow-twilio-to-talk-to-your-aspnet-core-application-with-ngrok
which indicates removing https App Url.

Kaa REST log appender issue

I have configured REST appender on DataCollectionDemo on the Sandbox. I have configured host = localhost, "/" at the end and beginning of URI path, no ssl. I have a http listener running on my localmachine. I have also disabled firewall on my machine. Now I cant receive the POST method on my server. Please help.
Key errors faced and their solutions while deploying Kaa REST log appender:
Error 500: I found two errors with my configuration of RestLogAppender in the admin panel. First, I had put http:// before my host. Had to remove the same. Second, I should have mentioned Relative URI path starting and ending with a forward slash /.
Error 400: I had given slightly different names to the JSON fields in the Django models. The sequence of the fields did not matter but the name of fields did matter.

Resources