Dealing With Cross-Origin Resource Sharing (CORS)

CORS is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. The same-origin security policy of JavaScript forbids certain cross-domain requests, notably Ajax requests, by default.

Rejected resource requests due to CORS can affect web or hybrid mobile applications. Applications that encounter a rejection receive messages such as the following example in response to resource requests:

No 'Access-Control-Allow-Origin' header is present on the requested resource.

Server-side administrators can specify the origins allowed to access their resources by modifying the policy used by their remote server to allow cross-site requests from trusted clients. For example, to access a remote service managed by Oracle’s Mobile Cloud Service (MCS), an MCS administrator configures MCS’s Security_AllowOrigin environment policy with a comma-separated list of URL patterns that identify the remote services that serve resources from different domains.

If you serve your web or hybrid mobile application to the local browser for testing, you may encounter CORS rejections. Some browsers provide options to disable CORS, such as Chrome's --disable-web-security and Firefox's security.fileuri.strict_origin_policy and some browsers support plugins that work around CORS.

Only use these options when testing your application and ensure that you complete further testing in a production-like environment without these options to be sure that your application will not encounter CORS issues in production.

The default web views used by hybrid mobile applications do not implement CORS and therefore hybrid mobile applications will not encounter CORS issues when run on a device in the default web view. However, if you use an alternative web view, such as WKWebView on iOS, you may encounter CORS issues. To work around this on iOS, consider using the cordova-plugin-wkwebview-file-xhr plugin in your hybrid mobile application as an alternative to WKWebView. For additional information, see Using a Different Web View in your JET Hybrid Mobile App.