Edit Question - KnowledgeHub

Title Body

I have been following the Mozilla article on how to set up my website to allow Cross-site scripting requests . Using IIS Manager I have added the following HTTP Response Headers Access-Control-Allow-Origin : * Access-Control-Allow-Headers : Origin, SecurityPrivateKeyID Access-Control-Allow-Methods : GET, POST, PUT, DELETE, OPTIONS Despite this I keep getting a 405 Method Not Allowed when my browsers (Firefox and Chrome) send the pre-flight request with a custom SecurityPrivateKeyID header. Request OPTIONS /Service/Json/User.svc/ HTTP/1.1 Host: serviceprovider.com User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://client.com Access-Control-Request-Method: GET Access-Control-Request-Headers: securityprivatekeyid Connection: keep-alive Response HTTP/1.1 405 Method Not Allowed Allow: GET Content-Length: 1565 Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/8.0 access-control-allow-origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: Origin, SecurityPrivateKeyID Date: Sat, 23 Mar 2013 08:35:03 GMT The service works fine when accessing directly at http://serviceprovider.com/Service/Json/User.svc/ . Any ideas on what I am doing wrong? [note I have changed my hosts files to point client.com and serviceprovider.com at my machine] [a solution using JSONP will not do as my web service must be able to consume POST, PUT and DELETE methos]

Tags (comma-separated) Cancel