3
votes

I'm using the method described at https://github.com/ServiceStack/ServiceStack/wiki/New-Api to enable CORS. This seems to work, i.e. I get the correct Access-Control headers back in the response, but the status code is a 404. Does this matter?

For completeness I'd prefer to return a non-error code. Reading http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html it seems as though I ought to be returning a 200. What's the best way to do this?

The service method definition is:-

    [EnableCors]
    public void Options(ApiKeyRequest apiKeyRequest)
    {
    }

The HTTP request is:-

OPTIONS http://myreallycoolwebapi/apikeyrequests HTTP/1.1
Host: myreallycoolwebapi
Connection: keep-alive
Access-Control-Request-Method: POST
Origin: http://localhost:8000
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
Access-Control-Request-Headers: origin, content-type, accept
Accept: */*
Referer: http://localhost:8000/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-GB,en-US;q=0.8,en;q=0.6
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

and the response is:-

HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 17 Nov 2012 18:06:01 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 3
Connection: keep-alive
Cache-Control: private
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type

404

UPDATE 1

This is my resource type.

[Route("/apikeyrequests", "POST")]
public class ApiKeyRequest : IReturn<ApiKeyRequest>
{
    public string EmailAddress { get; set; }
}

The POST requests work just fine.

2
Can you show the [EnableCors] service that you're using and the request you're making that's giving you a 404? - mythz
@mythz I've added those - let me know if you need more info - Adam Ralph
Damn, just come across this issue myself. Would have expected a 405 (according to HTTP Spec) rather than a 404. - Bealer

2 Answers

3
votes

I still haven't seen anything matching the expected route /apikeyrequests.

Do you have a custom route definition, e.g:

[Route("/apikeyrequests")]
public class ApiKeyRequest {}

Added for the request?

2
votes

The CORS spec itself explicitly indicates that a non-200 preflight response is an error. See the "If the response has an HTTP status code that is not 200" section here:

http://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0

I don't know what the motivation is for this requirement. Perhaps its because a 404 could introduce confusion as to whether the endpoint actually exists.