Getting 403 error while call 3rd party api

Question

when i call the 3rd party API from postman its working fine but in angular i got 403 error https://gsp.adaequare.com/test/enriched/ewb/ewayapi/GetEwayBill?ewbNo=351001073457 403

Access to XMLHttpRequest at 'https://gsp.adaequare.com/test/enriched/ewb/ewayapi/GetEwayBill?ewbNo=351001073457' from origin 'http://localhost:4200' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Answer 1

Your Angular app is running into this error due to Same Origin Policy. Means that every AJAX request must match the exact host, protocol, and port of your site. This error is not Angular specific and inflicts all web applications. This error can occur if

• Hitting a server from a locally-served file (a request from file:///YourApp/index.html to http://api.awesome.com)
• Hitting an external API (a request from http://yourapp.com to http://api.awesome.com).
• Hitting an internal API (a request from http://yourapp.com to http://api.yourapp.com). Hitting a different port on the same host (webapp is on http://localhost:3000, API is http://localhost:4000)
• Requesting over http from https or vice-versa (requesting https://yourapp.com from http://yourapp.com

To solve this error one way is to modify headers. CORS (Cross-Origin Resource Sharing) s a way for the server to say “I will accept your request, even though you came from a different origin.” This requires cooperation from the server – so if you can’t modify the server (e.g. if you’re using an external API), this approach won’t work.

Modify the server to add the header Access-Control-Allow-Origin: * to enable cross-origin requests from anywhere (or specify a domain instead of *). This should solve your problem.

Answer 2

browser are more strict, if you call different domain, than server have to answer with specific headers

and if you use POST request with content-type: "application/json" (and few more) server also have to correct answer to preflight OPTIONS reqest sent by browser, and you can do nothing with it, security reasons, here's more: https://stackoverflow.com/a/29954326/9177552

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS