Document Problems with CORS

[voracityemail]

I don’t have the “answer” sorry - we don’t use ajax for access, but are the following any help?

[ Updated response - sorry missed the ref. to Chrome - so do the following posts help?

CORS request with Preflight and redirect: disallowed. Workarounds?

Chrome cancels CORS XHR upon HTTP 302 redirect

]

Check the browser type / version - “In the initial definition of the CORS-standard, redirects after a successful CORS-preflight request were not allowed. IE11 implements this (now outdated) standard.”
This also seems to affect some versions of other browsers (e.g. Chrome - see http - CORS request with Preflight and redirect: disallowed. Workarounds? - Stack Overflow)

See:

Ajax request with CORS redirect fails in IE11

Check the http headers sent in the ajax request and the response.

As you’ve found, if there’s a redirect behind the scenes (as here) ajax should automatically try to follow this. For info see the post:

Requesting Documents from filing history

using the following:- $(document).ready(function () { var settings = { “dataType”: “json”, “async”: true, “crossDomain”: true, “url”: “https://document-api.companieshouse.gov.uk/document/hNbsxQ32rS3uPgZRcCd-wxV1tXsGZ0Ik3E_tYva8iWw/content”, “method”: “GET”, “headers”: { “Accept”: “application/pdf”, “authorization”: "Basic " } } $.ajax(settings).done(function (response) { alert ("IT WORKED " + response); }) }) // JavaScript Document yet i get the following:- XMLHttpRequest ca…

There’s also a post covering various CORS issues (when accessing the main API):

Ajax post to JSON API

I’m trying to use Ajax to POST a request to the new JSON API. The request works from the Companies House test page (which suggests that the Application key is correct) but is not working from an HTML page when served from the same domain as the Application JavaScript domain. When I try the request below, I see the following error: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘http://ericernie.co.uk’ is therefore not allowed access. The response had HTTP …

For a good general explanation of cross-origin CORS, which seems to cover the same situation that occurs accessing the CH documents, try:

Cross-domain Ajax with Cross-Origin Resource Sharing - Human Who Codes

For reference - not relevant to your particular issue but if anyone searches this post to find how this redirect works - the process of requesting a CH document goes:

1. For a given document I request the document metadata via CH Document API:
   GET https://document-api.companieshouse.gov.uk/document/JlaD_eQnrj6jfF4HgtRUYqU4EINOpYGnwl-ljdLqrIQ

CH send the response (some headers trimmed):
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: application/json
…followed by the JSON body (document metadata resource object).

2. I parse the JSON to get the document types available and the document URI. I then request this via the fetch document endpoint:
   GET https://document-api.companieshouse.gov.uk/document/JlaD_eQnrj6jfF4HgtRUYqU4EINOpYGnwl-ljdLqrIQ/content
   (I specify the content type I want to accept via the appropriate http header e.g. “Accept:application/pdf”)

CH send back a response which is a redirect to the document (stored on Amazon):

HTTP/1.1 302 Found
Location: https://s3-eu-west-1.amazonaws.com/document-api-images-prod/docs/JlaD_eQnrj6jfF4HgtRUYqU4EINOpYGnwl-ljdLqrIQ/application-pdf?AWSAccessKeyId=ASIAI3K {lots more but I’ve trimmed the URI}

3. I request this URI from Amazon again passing the content type I want to accept again. ( I don’t think you need to send the CH authorization headers. Presumably it’s not an issue if you do (e.g. if this automatically occurs via Ajax), I don’t know though. ):

GET https://s3-eu-west-1.amazonaws.com/document-api-images-prod/docs/{…rest chopped}
Accept:application/pdf

4. Amazon responds with a http 200 and the document data.