Reference services are not CORS-enabled

[alexis-y]

And thus can not be used from a web browser for testing JS, for instance.

Example request:

OPTIONS http://services.odata.org/V3/Northwind/Northwind.svc/$metadata HTTP/1.1
Accept: */*
Origin: http://localhost:50854
Access-Control-Request-Method: GET
Access-Control-Request-Headers: accept, maxdataserviceversion
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: services.odata.org
Content-Length: 0
DNT: 1
Connection: Keep-Alive
Pragma: no-cache
MaxDataServiceVersion: 3.0

and it's response:

HTTP/1.1 501 Not Implemented
Cache-Control: private
Content-Length: 195
Content-Type: application/xml;charset=utf-8
Expires: Thu, 30 Jul 2015 18:31:03 GMT
Vary: *
Server: Microsoft-IIS/8.0
X-Content-Type-Options: nosniff
DataServiceVersion: 1.0;
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Headers: Accept, Origin, Content-Type, MaxDataServiceVersion
Access-Control-Expose-Headers: DataServiceVersion

Notice the response headers claim to allow CORS, but the response is Not Implemented.

Workaround

None that I know. I'd tipically just uso JSONP, but $metadata can not be requested by JSONP.

[dingeins]

@alexis-y Thank you for reporting. Is this happening to V3 sample services only? Are you also testing V4 services?

[alexis-y]

This happens in V2, V3 and V4. I did not test the other reference services, only Northwind.

[dingeins]

@alexis-y An issue is created on the sample services repo. Please follow the reference I newly added to monitor its status.

[alexis-y]

Great, will follow up there