Why doesn't Chrome and Firefox send FormAuthentication cookie in Ajax request - asp.net

I am using the following blob of jQuery to issue requests to a WCF Ajax enabled webservice
The site itself is hosted at localhost:80 and the WCF services at localhost:8080
$.ajax({
type: "POST",
url: String.format(Service, Method),
contentType: "application/json; charset=utf-8",
data: JSON.stringify(Data),
timeout: 6000,
dataType: "json",
success: function (e) { OnSuccess(e); },
error: function (e) { OnFailed(e); }
});
This works fine in IE but when I attempt to run this code in Chrome or Firefox (even after the user has been authenticated) I receive the error HTTP/1.1 401 Unauthorized. After running fiddler its clear why, as chrome is not sending the Cookie .ASPXFORMSAUTH that I have configured for forms authentication.
Specifically this is what the IE request looks like
POST /SchedulerService.svc/GetAllEventsByCurrentUser HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/json; charset=utf-8
Referer: http://localhost/Calendar/Calendar.aspx
Accept-Language: en-AU
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Connection: Keep-Alive
Content-Length: 0
DNT: 1
Host: localhost:8080
Pragma: no-cache
Cookie: ASP.NET_SessionId=dmz5jv3oxa0llsph0thh1443; .ASPXFORMSAUTH=5EA7CB8124C5077933A639062999A89D35D440C6AD1A038C83A42D34694C20886506721D3CCD899BDA7B705CEF3B3024368AD6AE4523DEBDC5891E8DDD478206A3C2EF852345F70812F01D30F8F1041C2113EA2836CC5353FEAF81FC3EBF4DB6921D6DB270DE5C4102321DDD4D3923082B890995195990088749A1815B6A0BE5
VS CHROME
POST /SchedulerService.svc/GetAllEventsByCurrentUser HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Content-Length: 0
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.94 Safari/537.36
Content-Type: application/json; charset=utf-8
Referer: http://localhost/Calendar/Calendar.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-AU,en;q=0.8,en-US;q=0.6,en-GB;q=0.4
Could anyone provide any guidance on what might be going wrong? I realize I may need to provide more information but not sure what else is relevant.
EDIT: Well after trying many, many different ideas it seems to me that all my problems likely stem from a drastic difference in implementation of the same origin policy between IE, Chrome and Firefox. Will update when I have more...

As your asp.net and wcf applications seem to be hosted on different ports (80 and 8080), you may give a try to beforeSend to send credentials :
$.ajax({
type: "POST",
url: String.format(Service, Method),
contentType: "application/json; charset=utf-8",
data: JSON.stringify(Data),
timeout: 6000,
dataType: "json",
success: function (e) { OnSuccess(e); },
error: function (e) { OnFailed(e); },
beforeSend: function(xhr){
xhr.withCredentials = true;
}
});
see https://stackoverflow.com/a/2054370/1236044

Related

make flask return response header http1.1 instead http1.0 [duplicate]

I have a jQuery Ajax call, like so:
$("#tags").keyup(function(event) {
$.ajax({url: "/terms",
type: "POST",
contentType: "application/json",
data: JSON.stringify({"prefix": $("#tags").val() }),
dataType: "json",
success: function(response) { display_terms(response.terms); },
});
I have a Flask method like so:
#app.route("/terms", methods=["POST"])
def terms_by_prefix():
req = flask.request.json
tlist = terms.find_by_prefix(req["prefix"])
return flask.jsonify({'terms': tlist})
tcpdump shows the HTTP dialog:
POST /terms HTTP/1.1
Host: 127.0.0.1:5000
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/json; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://127.0.0.1:5000/
Content-Length: 27
Pragma: no-cache
Cache-Control: no-cache
{"prefix":"foo"}
However, Flask replies without keep-alive.
HTTP/1.0 200 OK
Content-Type: application/json
Content-Length: 445
Server: Werkzeug/0.8.3 Python/2.7.2+
Date: Wed, 09 May 2012 17:55:04 GMT
{"terms": [...]}
Is it really the case that keep-alive is not implemented?
The default request_handler is WSGIRequestHandler.
Before app.run(), Add one line,
WSGIRequestHandler.protocol_version = "HTTP/1.1"
Don't forget from werkzeug.serving import WSGIRequestHandler.
Werkzeug's integrated web server builds on BaseHTTPServer from Python's standard library. BaseHTTPServer seems to support Keep-Alives if you set its HTTP protocol version to 1.1.
Werkzeug doesn't do it but if you're ready to hack into the machinery that Flask uses to instantiate Werkzeug's BaseWSGIServer, you can do it yourself. See Flask.run() which calls werkzeug.serving.run_simple(). What you have to do boils down to BaseWSGIServer.protocol_version = "HTTP/1.1".
I haven't tested the solution. I suppose you do know that Flask's web server ought to be used for development only.

Why is my AJAX result not ETag-cached (no If-None-Match)?

Here is my AJAX function:
function ajax(url, data) {
return new Promise((resolve, reject) => {
$.ajax({
url: "https://xxx",
data: data,
method: 'POST',
timeout: 50000,
cache: true,
ifModified: true,
crossDomain: true,
success: (data, textStatus, jqXHR) => {
if (data == '#fail#') reject(data);
else {resolve(data);}
},
error: (jqXHR, textStatus, errorThrown) => {
reject(errorThrown);
}
});
});
}
As observed in Chrome -> Network(F12), this is the response header from the server:
HTTP/1.1 200 OK
X-Powered-By: Express
Access-Control-Allow-Origin: *
Content-Type: text/html; charset=utf-8
Content-Length: 3
ETag: W/"3-R7zlx09Yn0hn29V+nKn4CA"
Date: Fri, 06 Apr 2018 11:39:41 GMT
Connection: keep-alive
The request header is always identical, even in subsequent calls:
POST /register HTTP/1.1
Host: xxx:60001
Connection: keep-alive
Content-Length: 0
Accept: */*
Origin: http://localhost:8000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Referer: http://localhost:8000/index.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Shouldn't Chrome, upon receiving an ETag header, cache the resource and set the 'If-None-Match' header on subsequent calls to the same URL? Shouldn't I obtain a status code of 304 instead of 200 as the returned content is the same?
The calls to the resources in other servers such as the Google Map server do return 304 sometimes though.
This confirms that caching is generally limited to GET request methods only:
However, common HTTP caches are typically limited to caching responses to GET and may decline other methods. The primary cache key consists of the request method and target URI (oftentimes only the URI is used as only GET requests are caching targets)
This is also confirmed in a post in StackOverflow here.

.NET Application: Internal Server Error on ajax call

I know this is a issue discussed in many other threads, but I cannot understand what is not working in my case. I'm working on this asp.net application and I need to get some data via ajax call: everything works fine on my localhost, but I get an error 500 on production server, when ajax call is executed. The server is actually located on LAN, because this is an Intranet application.
These are the headers of the request:
Remote Address:192.168.2.152:80
Request URL:http://www.domain.tld/Ordini.aspx/Orders
Request Method:POST
Status Code:500 Internal Server Error
Request Headersview source
Accept:application/json, text/javascript, */*; q=0.01
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8,it;q=0.6,fr;q=0.4,es;q=0.2
Connection:keep-alive
Content-Length:18
Content-Type:application/json; charset=UTF-8
Host:www.domain.tld
Origin:http://www.domain.tld
Referer:http://www.domain.tld/Ordini
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
X-Requested-With:XMLHttpRequest
Request Payload
{'ordine': '3585'}
Response Headersview source
Content-Length:100
Content-Type:application/json; charset=utf-8
Date:Mon, 09 Jun 2014 10:59:43 GMT
jsonerror:true
Server:Microsoft-IIS/8.0
X-Powered-By:ASP.NET
In the preview tab (Chrome developer tools), I see nothing but a generic Error message and no stack track, or exception type.
I declared the method who has to process the request as a [WebService].
Since everything is working on my localhost, I guess my problem could be related only to IIS, but I don't know which settings may affect the actual behaviour.
*EDIT
This is the ajax call:
var ord = $("#ordine").val();
$.ajax({
type: "POST",
url: "Ordini.aspx/Orders",
data: "{'ordine': '" + ord + "'}",
contentType: "application/json; charset=utf-8",
dataType: "json",
success: OnSuccess,
error: function (xhr, ajaxOptions, thrownError) {
alert(xhr.responseText);
}
});
And this is the method called:
[WebMethod]
public static string Orders(string ordine)
{
string res = Ordine.GetOrderData(ordine);
return res;
}

Web API Object From Body is Null in IE

I have an asp.net web forms app where I'm trying to call ValidateRegistration1 method fro web api controller. It's doing fine in Firefox and Chrome but the object is null when I use IE. Content type and others seem almost the same. I couldn't find the problem.
Firefox POST in fiddler:
{Method: POST, RequestUri: 'http://localhost:5555/api/accounts/registervalidate1', Version: 1.1, Content: System.Web.Http.WebHost.HttpControllerHandler+LazyStreamContent, Headers:
{
Cache-Control: no-cache
Connection: keep-alive
Pragma: no-cache
Accept: */*
Accept-Encoding: gzip
Accept-Encoding: deflate
Accept-Language: en-US
Accept-Language: en; q=0.5
Cookie: __AntiXsrfToken=0871e412cceb47faa968c5563d19f8e1; ASP.NET_SessionId=glwlyn2mdihne0ev4uhc5fnv
Host: localhost:5555
Referer: http://localhost:5555/
User-Agent: Mozilla/5.0
User-Agent: (Windows NT 6.3; WOW64; rv:25.0)
User-Agent: Gecko/20100101
User-Agent: Firefox/25.0
X-Requested-With: XMLHttpRequest
Content-Length: 207
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
}}
IE POST in fiddler:
{Method: POST, RequestUri: 'http://localhost:5555/api/accounts/registervalidate1', Version: 1.1, Content: System.Web.Http.WebHost.HttpControllerHandler+LazyStreamContent, Headers:
{
Connection: Keep-Alive
Pragma: no-cache
Accept: */*
Accept-Encoding: gzip
Accept-Encoding: deflate
Accept-Language: en-US
Accept-Language: en; q=0.7
Accept-Language: tr; q=0.3
Cookie: __AntiXsrfToken=4772bed0c8e243f4a7893794ed176f47
Host: localhost:5555
Referer: http://localhost:5555/
User-Agent: Mozilla/5.0
User-Agent: (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0)
User-Agent: like
User-Agent: Gecko
X-Requested-With: XMLHttpRequest
Content-Length: 0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
}}
web api method
[Route("registervalidate1")]
//[ResponseType(typeof(Account))]
[HttpPost]
public HttpResponseMessage ValidateRegistrationStep1(HttpRequestMessage request,
[FromBody]AccountRegisterModel a)
{
HttpResponseMessage response = null;
List<string> errors = new List<string>();
bool isEmailFree = _accountService.EmailInUse(a.LoginEmail);
if (isEmailFree)
errors.Add("jj.");
if (errors.Count == 0)
response = request.CreateResponse(HttpStatusCode.OK);
else
response = request.CreateResponse<string[]>(HttpStatusCode.BadRequest, errors.ToArray());
return response;
}
I just ran into the same issue. The fix for me was to manually add the content type of "application/json" (contentType: 'application/json') to my jQuery ajax call. I'm sure you've found a solution to this by now but I'm posting this for others out there with the same problem.

Using AngularJS $http with asp.net webservice, is there a way to set the request headers?

I've just come across a bizarre issue with regards to retrieving data via asp.net webservice.
when using JQuery's ajax method the headers are set correctly and the data is retrieved in JSON successfully.
JSON example:
$.ajax({
type: "GET",
url: "service/TestService.asmx/GetTestData",
contentType: "application/json; charset=utf-8",
dataType: "json",
success: callback,
error: function (err, xhr, res) {
alert(err);
}
});
The Request Headers for the above is the following:
Accept application/json, text/javascript, */*; q=0.01
Accept-Encoding gzip, deflate
Accept-Language en-US,en;q=0.5
Content-Type application/json; charset=utf-8
Host localhost
Referer http://localhost/
User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0
X-Requested-With XMLHttpRequest
The Reponse Headers for above is the following:
Cache-Control private, max-age=0
Content-Length 327
Content-Type application/json; charset=utf-8
Date Tue, 29 Oct 2013 17:59:56 GMT
Server Microsoft-IIS/7.5
X-AspNet-Version 4.0.30319
X-Powered-By ASP.NET
this works fine.
But for AngularJS $http method the Request Headers Content-Type value is not set, therefore the Response Headers Content-Type defaults to text/xml; charset=utf-8. Have a look at the example below:
$http({
method : 'GET',
url: 'service/TestService.asmx/GetTestData',
headers: {
'Accept': 'application/json, text/javascript, */*; q=0.01',
'Content-Type': 'application/json; charset=utf-8'
}
}).success(callback);
The Request Headers for above is as follows, you will see that Content-Type is missing:
Accept application/json, text/javascript, */*; q=0.01
Accept-Encoding gzip, deflate
Accept-Language en-US,en;q=0.5
Host localhost
Referer http://localhost/ComponentsAndRepos/
User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0
therefore the Response Headers for the above is the following:
Cache-Control private, max-age=0
Content-Encoding gzip
Content-Length 341
Content-Type text/xml; charset=utf-8
Date Tue, 29 Oct 2013 17:59:56 GMT
Server Microsoft-IIS/7.5
Vary Accept-Encoding
X-AspNet-Version 4.0.30319
X-Powered-By ASP.NET
therefore this forces the response to return as XML not JSON, is there a way to resolve this?
thank you,
Update
Thanks to Erstad Stephen
This has been resolved by adding data:{} property to $http method.
$http({
method : 'GET',
url: 'service/TestService.asmx/GetTestData',
data: {},
headers: {
'Accept': 'application/json, text/javascript, */*; q=0.01',
'Content-Type': 'application/json; charset=utf-8'
}
}).success(callback);
You can handle this a couple of different ways:
You can set the header defaults through the $httpProvider: http://docs.angularjs.org/api/ng.$http#description_setting-http-headers
You can also use the Interceptors in Angular to intercept the idea for $http to modify the config object for all requests: http://docs.angularjs.org/api/ng.$http#description_interceptors
You could also set the config setting like you are above.
The biggest thing is that you maybe misunderstanding how the config works. See this question here: Angular, content type is not being generated correctly when using resource

Resources