# Web Dev Response Headers

**URL:** <https://forum.inductiveautomation.com/t/web-dev-response-headers/11577>\
**Category:** Ignition\
**Created:** [April 25, 2016, 10:06pm UTC](https://forum.inductiveautomation.com/t/web-dev-response-headers/11577 "2016-04-25T22:06:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![r\_beall](https://avatars.discourse-cdn.com/v4/letter/r/90ced4/32.png) [@r\_beall](https://forum.inductiveautomation.com/u/r_beall)\
**Post date:** [April 25, 2016, 10:06pm UTC](https://forum.inductiveautomation.com/t/web-dev-response-headers/11577/1 "2016-04-25T22:06:02Z")

</div>

I'm wondering if there's a way to manipulate the response headers of a doGet method in the Web Dev module. I need to add 'Access-Control-Allow-Origin' to the headers of the response object to allow other domains/servers/sites access to the end points. Javascript has built in security restraints (CORS) to guard against Cross Site Scripting. This is usually negated by adding Access Control in the header response.

I know my code is working because I can easily get the data when consuming the end point from the same server, this is only a problem when using a site on another host (same network).

Here's the main error I get in the browser:

> [@](#):
>
> XMLHttpRequest cannot load [myURL..](http://myURL..). No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '[http://SERVERNAME:9999](http://SERVERNAME:9999)' is therefore not allowed access.

Here's the HTML5 explanation, basically saying you need to add this Header to the response object.  
[html5rocks.com/en/tutorials/ ... the-server](http://www.html5rocks.com/en/tutorials/cors/#toc-adding-cors-support-to-the-server)

[code]headers = request['headers']  
headers.update({"Access-Control-Allow-Origin":"[http://SERVERNAME](http://SERVERNAME)"})

jsonObject = {"one":"two"}

response = system.util.jsonEncode(jsonObject)

#how do I add this to the actual response (not just the variable)  
headers = system.util.jsonEncode(headers)

#I've tried adding them to the request then returning the request but to no avail  
request['headers'] = headers  
request['servletResponse'] = response

#I've tried all the different response types json, html, response, etc  
return {'response': (response)}

[/code]

Any ideas?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [April 26, 2016, 12:32am UTC](https://forum.inductiveautomation.com/t/web-dev-response-headers/11577/2 "2016-04-26T00:32:00Z")

</div>

Try getting the servletResponse, setting the header on it, then returning the response data.

```auto

servletResponse = request['servletResponse']
servletResponse.setHeader('Access-Control-Allow-Origin', 'http://SERVERNAME')

... do whatever and return a response ...

```

---

<div class="post-metadata">

**Author:** ![r\_beall](https://avatars.discourse-cdn.com/v4/letter/r/90ced4/32.png) [@r\_beall](https://forum.inductiveautomation.com/u/r_beall)\
**Post date:** [April 26, 2016, 3:12pm UTC](https://forum.inductiveautomation.com/t/web-dev-response-headers/11577/3 "2016-04-26T15:12:36Z")

</div>

Solid, that worked!

```auto
	#this is pretty dirty, but it works.
	from javax.servlet.http import HttpServletResponse
	jsonObject = system.util.jsonEncode(LISTOBJECT)
	HttpServletResponse = request['servletResponse'] 
	Response = (HttpServletResponse) 
	Response.addHeader('Access-Control-Allow-Origin', '*' )
	writer = Response.getWriter()
	writer.println(str(jsonObject))
	writer.close	
	return None
```

---

<div class="post-metadata">

**Author:** ![justin.sunseri](https://avatars.discourse-cdn.com/v4/letter/j/6a8cbe/32.png) [@justin.sunseri](https://forum.inductiveautomation.com/u/justin.sunseri)\
**Post date:** [December 7, 2018, 3:19pm UTC](https://forum.inductiveautomation.com/t/web-dev-response-headers/11577/4 "2018-12-07T15:19:51Z")

</div>

Is there any way that I can globally set up all calls to have these headers in their response (even 4\*\* responses)? My calls require authentication and I can’t seem to add the authentication header to my preflight requests. Another possible solution would be to exempt the option verb from needing authentication.