IE9 X-Frame-Options deny upload

Question

I have big problems here. I got a .Net MVC 4 application that uses the Kendo interface as a base layout and for download. The download works fine in all browsers except IE9 (9.0) running on Windows Server 2008 RC2 x64 - I don't know if this data is important.

This gives me a SCRIPT5: Access Denied error when Kendo tries to send an asynchronous call. According to this post by a member of Telerik in the kendo user interface, Kendo creates an iframe to make asynchronous downloads possible in previous versions prior to IE10.

I tried adding a header to the webconfig api:

 <customHeaders> <add name="Access-Control-Allow-Credentials" value="true" /> <add name="X-Frame-Options" value="ALLOW-FROM *"/> </customHeaders> 

Other headers for CORS are the implication installed on the CORS Handler Class like this on the api.

So, I see this header in the response headers in the IE request, so IE retrieves it. I do not know the support - especially in IE - for the value ALLOW-FROM nor when accepting * . But I tried to use the SAMEORIGIN value for this header, and it did not work, and I have a reason for this: My WebApi is not at the same address as Front-End. different servers and add-ons. Download is sent directly to Api at this URL:

http://dev.******.com/webserviceapi/api/UserProfile/Upload

And Front-End is in:

http://dev.******.com/portal/

The suppressed content in the URL is the same for both addresses.

So, I have no idea how to achieve this. This error does not fit into anything that I found on the Internet. Any help would be greatly appreciated! Thank you in advance.

Answer 1

I think this may be an open state,

Use this

if (xhr.readyState == 1 /* OPENED */)

it opens on the server side, a connection to the server has opened, see this

If you used this class from msdn blog

public class ValuesController : ApiController

if the class is not public, then you may also get an error .. before CORS ..

You saw the second blog comment ...

jQuery.support.cors = true; you need to change this so that it explicitly supports non-supporting cross domains, the following comment says ...

that flag tells jQuery to use an alternative object for making cross-domain calls if the browser doesn't natively support it on its XmlHttpRequest implementation. For example, in IE8 that will cause jQuery to switch from XmlHttpRequest to the **XDomainRequest** object (in IE10 they "fixed" it in a way that XmlHttpRequest can be used for all requests). Regardless of the object on the client, the server still needs to "play the game" and return the appropriate headers so that the browser will allow such requests to be made.

Yes, the message from a member of the Teleric Team is logically perfect, but each IE has its own way of dealing with events and the system (it hurts, this is one of those .. BUG). I have not yet found a list of IE9 errors, but there is one link in which IE8 errors are simply referenced, if this applies, this is useful as we know what we need to deal with. :)

Try readyState == 2 if this works fine.

I think there must be some little thing that you are missing.

link to the second article from the same author in the msdn blog

indicate this if quirkmode helps

I am not a regular user of mvc, so I can not judge this situation, other aspects properly.

I’m looking for other reasons, I’ll publish it if I find something related.

Hope this helps ...