How to use Breeze IQueryable with CORS?

Question

I use a method to add CORS handlers to my response that is called by a client using Breeze.

You can read more about how I got that working here: Controller not filtering data in Breeze query in DotNetNuke Module

However, I noticed that while $filter works, $expand and $select do not.

So my question is: How can I use return a HttpResponseMessage Type and still use Breeze (I need to do this for CORS).

To prove this, I downloaded and changed the Todos sample:

Original method (works)

http://example/api/todos/todos?$select=isdone

[HttpGet]
public IQueryable<TodoItem> Todos()
{
    return _contextProvider.Context.Todos;
}

My method with CORS wrapper (does not expand or select)

http://example/api/todos/TodosCors?$select=isdone

[HttpGet]
[Queryable(AllowedQueryOptions = AllowedQueryOptions.All)]
public HttpResponseMessage TodosCors()
{
    var response = Request.CreateResponse(HttpStatusCode.OK, (IQueryable<TodoItem>)_contextProvider.Context.Todos);
    return ControllerUtilities.GetResponseWithCorsHeader(response);
}

    public static HttpResponseMessage GetResponseWithCorsHeader(HttpResponseMessage response)
    {
        response.Headers.Add("Access-Control-Allow-Origin", "*");
        return response;
    }

Ward Ward · Accepted Answer · 2013-07-05T00:12:42

I'm going to comment mainly on the CORS aspect of your question. The part about $expand and $select is addressed in the StackOverflow question to which you refer. In brief, [Queryable] is the Web API attribute which does not support $expand and $select. I think you want the [BreezeQueryable] attribute that does.

I can not say for sure but I do not believe the code you show is the proper way to implement CORS for the Web API. At least I've not seen it done this way.

There are two ways known to me; both involve adding message handlers.

The first is the way we did it in the Breeze Todo sample; the second is the with the Web API CORS support that is on the way.

The way we did it is simplistic but effective. We don't talk about it because we intend to defer to the the approved Web API way when it arrives (soon I hope).

In the Todo demo, look for App_Start/BreezeSimpleCorsHandler.cs. You can just copy it into your own App_Start folder with no changes except to the namespace.

Then your server has to call it. In the Todo sample we did so in the BreezeWebApiConfig.cs but you could put it in Global.asax or in anything that is part of the server boot logic.

      // CORS enabled on this server
      GlobalConfiguration.Configuration.MessageHandlers.Add(new BreezeSimpleCorsHandler());

As it happens, someone has tried Breeze with the forthcoming Web API CORS NuGet package ... and discovered a bug in Breeze. We have to work that through ... and we will. We really want that way to be THE way.

Until then, you can follow the Todo sample precedent.

How to use Breeze IQueryable with CORS?

1 Answers