CORS errors when proxy is utilized.

[ChristopherSchreiber]

Hello all!

I am working on a road closure app that will be constructed using the Web AppBuilder (Developer Edition). Because it will be embedded into another website we are going to host it locally and utilize the Esri proxy (from GitHub) to bypass the need for credentials.

I am having issues when trying to access hosted layers from ArcGIS Online. I needed to add the "Access-Control-Allow-Origin" to the page header to access our organization's ArcGIS Online Account for the app to work.

When I add this, the browser then comes back with the following error:

"The 'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed. Origin 'www.mysite.com' is therefore not allowed access."

I have checked both the app's page and the proxy's page on IIS and I cannot locate a second value.

Where do I need to go to find this second value?

Thank you!

P.S. I am new to CORS, so I am learning as I go.

[ChristopherSchreiber · Accepted solution]

Hello all!

Just to update, after working with Esri Technical Support, we were able to figure out the cause of the problem.

I was using the same web server to host both the Web AppBuilder app and the proxy service available on GitHub.

They had the same URL with the exception of the port number.

     Ex:

          App URL: https://mywebserver.com:443/app/

          Proxy URL: https://mywebserver.com:444/DotNet/proxy.ashx

I found out that, even though they are hosted using the same web server, because the port numbers are different, the browser was treating them as different origins, thus, causing my CORS errors.

My Solution was to remove the proxy site completely from IIS. Then I added the proxy to the app's site as a virtual directory. Now that they are both pulling from the same URL with the same port, there are no more CORS errors! (I have attached an image of the app's directories in IIS)

This may be standard knowledge, but to anyone else new to the web development game, I thought this may help.

Thank you,

Chris Schreiber