0

To test AngularJS, I took the following code is right from the "Wire up a Backend" example off the http://angularjs.org/ home page. When the views are local everything works as expected but when I move the views to another URL I get a 403. See the jsbin example here:

http://jsbin.com/olavok/1/edit

OPTIONS ... 403 (Forbidden) angular.min.js:99 XMLHttpRequest cannot load .... Origin http://jsbin.com is not allowed by Access-Control-Allow-Origin.

However, jQuery works just fine. Right in the same jsbin I added a jQuery ajax call and we see JQUERY SUCCESS in the logs. If you look at the result you see jQuery delivered the view.

Any thoughts on how to get Angular to play nice cross site? I read that angular is using "jQuery light" for DOM. Is there a way to get angular to fall-back and use jQuery for ajax?

JStark
  • 2,698
  • 2
  • 26
  • 36

1 Answers1

0

It appears to be by design: http://docs.angularjs.org/api/ng.$http

Read the section on Cross Site Request Forgery (XSRF) Protection.

I just noticed the 403 is coming back from the OPTIONS verb, not GET. jQuery works because it simply does GET, but Angular's $http seems to play by the rules:

AngularJS performs an OPTIONS HTTP request for a cross-origin resource

Community
  • 1
  • 1
Langdon
  • 19,288
  • 17
  • 84
  • 106