Ajax post to JSON API

[andywigan]

I’m trying to use Ajax to POST a request to the new JSON API. The request works from the Companies House test page (which suggests that the Application key is correct) but is not working from an HTML page when served from the same domain as the Application JavaScript domain.

When I try the request below, I see the following error:

No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘http://ericernie.co.uk’ is therefore not allowed access. The response had HTTP status code 401.

$.ajax({
    url: "https://api.companieshouse.gov.uk/search/companies?q=sandstone",
    beforeSend: function(xhr) { 
      xhr.setRequestHeader("Authorization", "Basic  xxxxxxx"); 
    },
    type: 'GET',
    dataType: 'text',
	 crossDomain: true,
        async: false,
        cache: false,
    contentType: 'application/json',
    processData: false,
    success: function (data) {
      alert(JSON.stringify(data));
    },
    error: function(){
      alert("Cannot get data");
    }
});

Any help gratefully received.

Thanks

Andy

[csmith]

This might be because your AJAX query is not sending the Origin header. This is mandatory for CORS to work. See the following… let us know if that does fix your issue?

Jquery Ajax Get request

In your API key registration, did you configured the domain (s) that you are making the Ajax request from? If you do not do this, our API will not negotiate permission with the CORS protection implemented by your client. Generally, an API with CORS protection will compare the Origin: header sent by a JS client against an authorisation list. If a match is made, an Access-Control-Allow-Origin: matched-domain is sent back which authorises the client. Log onto the developer hub and edit your API k…

[andywigan]

Hi

I included the domain of the site when I registered the application key.

Is there a non-forum channel I can use to discuss this issue?

Thanks

Andy

[andywigan]

Hi

The Origin header is specified in the request, and this matches (one of) the JavaScript domains configured against the account.

The browser console (in Chrome) is reporting the following errors:

12:35:33.421 This site makes use of a SHA-1 Certificate; it’s recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.1 companies

12:35:33.463 Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://api.companieshouse.gov.uk/search/companies?q=sandstone&_=1436873733231. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).1

Thanks

Andy

[clucas1976]

I am having this issue now:- how was it resolved?

[mfairhurst]

@clucas1976

Could you possibly provide a snapshot of the request/response headers that are being sent/returned so we can perform some further investigation, as per: -

Thanks

@mfairhurst

[clucas1976]

Hope these help !!

[mfairhurst]

@clucas1976,

Could you try removing the cache-control header and see if that works. Also what specific error message are you encountering?

Thanks,

Mark.

[clucas1976]

Still not working

[mfairhurst]

@clucas1976,

Looking at the header sent you are requesting using http

but we can only see HTTPS https://www.ltdonline2.com defined as domains against api keys? Have you defined a domain with HTTP

Thanks

Mark.

[clucas1976]

I have changed it to see if that makes a difference.

[mfairhurst]

@clucas1976

The error message now seems to relate to the authorisation being used. The authorisation key to be sent should be the base 64 of

API Key + :

The colon needs to be appended before encoding, and then not appended to the encoded string.

Thanks

Mark.

[clucas1976]

Mark, you are a star, all sorted !!! Thank you

[mfairhurst]

Excellent news…

[info10]

Can someone update with working example of this?

Thank you