# Webdev Module and AJAX **URL:** \ **Category:** Ignition\ **Tags:** ignition79\ **Created:** [February 21, 2018, 3:15pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073 "2018-02-21T15:15:37Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![ctonge](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@ctonge](https://forum.inductiveautomation.com/u/ctonge)\ **Post date:** [February 21, 2018, 3:15pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/1 "2018-02-21T15:15:37Z")
Has anyone been involved in development of a web interface using AJAX for API calls to the Ignition server? We’re running into CORS issues and I’m trying to understand what needs to be done on the Ignition web app in Jetty (if anything) to set up CORS filters, and then the corresponding requirements on the AJAX side. Any help is much appreciated! Clint. ---
**Author:** ![Sanderd17](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sanderd17/32/8735_2.png) [@Sanderd17](https://forum.inductiveautomation.com/u/Sanderd17)\ **Post date:** [February 22, 2018, 7:16am UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/2 "2018-02-22T07:16:17Z")
This post will probably help: > [@Web Dev Response Headers](http://forum.inductiveautomation.com/t/web-dev-response-headers/11577): > > I’m wondering if there’s a way to manipulate the response headers of a doGet method in the Web Dev module. I need to add ‘Access-Control-Allow-Origin’ to the headers of the response object to allow other domains/servers/sites access to the end points. Javascript has built in security restraints (CORS) to guard against Cross Site Scripting. This is usually negated by adding Access Control in the header response. I know my code is working because I can easily get the data when consuming the end p… ---
**Author:** ![ctonge](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@ctonge](https://forum.inductiveautomation.com/u/ctonge)\ **Post date:** [February 23, 2018, 7:21pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/3 "2018-02-23T19:21:15Z")
Amazing, got it working with that helpful tidbit…unfortunately that one doesn’t show up in a ‘webdev’ search since they call it ‘Web Dev’… ---
**Author:** ![ctonge](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@ctonge](https://forum.inductiveautomation.com/u/ctonge)\ **Post date:** [March 2, 2018, 2:59pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/4 "2018-03-02T14:59:38Z")
Just an FYI for anyone running into this as well. This worked only when authentication was not required on my Python resource. With authentication forced I did need to make changes to Jetty in the web.xml file to include the OPTIONS method in the allowedMethods, and in the allowedOrigins set a wildcard \* as the value. Otherwise in an ajax get or post method, the preflight message with auth fails (as it is sent as an OPTIONS method, and requires that the server allow the originating client in the cross-origin filter. In the end I ended up creating a custom authentication API using the ignition users and the system.security.validateUser() function. I then generate a unique key for the session and send it to the browser in the response. This way I can control the sessions and time them out when I want to on the server side. ---
**Author:** ![justin.sunseri](https://avatars.discourse-cdn.com/v4/letter/j/6a8cbe/32.png) [@justin.sunseri](https://forum.inductiveautomation.com/u/justin.sunseri)\ **Post date:** [December 6, 2018, 11:45pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/5 "2018-12-06T23:45:46Z")
ctonge, Could you please include a little bit more details about the changes you made to the web.xml file? I’m also struggling with the fact that I need authorization on all my calls but I can’t seem to add the authorization headers to my pre-flight requests. for each of my “controllers” I’ve added an OPTIONS response like this: servletResponse.setHeader(‘Access-Control-Allow-Origin’, ‘_’) servletResponse.setHeader(‘Access-Control-Allow-Headers’, '_’) servletResponse.setHeader(‘Access-Control-Allow-Methods’, ‘\*’) It would be great if I could set this in an xml file and not have to copy this into the options request of every “controller” ---
**Author:** ![c-w-t](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@c-w-t](https://forum.inductiveautomation.com/u/c-w-t)\ **Post date:** [December 10, 2018, 9:51pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/6 "2018-12-10T21:51:24Z")
Hey sorry for the delayed response. I’ve had to go back to my notes on this. You have to add the jetty servlets jar per below: _$ sudo cp jetty-servlets-9.3.8.v20160314.jar /usr/local/bin/ignition/webserver/webapps/main/WEB-INF/lib_ Then add the following to the web.xml file: ```auto cross-origin org.eclipse.jetty.servlets.CrossOriginFilter allowedOrigins * allowedMethods GET,POST,DELETE,PUT,HEAD allowedHeaders origin, content-type, accept cross-origin /* ``` This worked for me on version 7.9.7, but haven’t tried with any versions since. Hope it works for you. ---
**Author:** ![c-w-t](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@c-w-t](https://forum.inductiveautomation.com/u/c-w-t)\ **Post date:** [December 12, 2018, 4:56pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/7 "2018-12-12T16:56:54Z")
And sorry for my switching of account names! LOL. ---
**Author:** ![justin.sunseri](https://avatars.discourse-cdn.com/v4/letter/j/6a8cbe/32.png) [@justin.sunseri](https://forum.inductiveautomation.com/u/justin.sunseri)\ **Post date:** [December 17, 2018, 3:50pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/8 "2018-12-17T15:50:39Z")
I tried to do this to my C:\Program Files\Inductive Automation\Ignition\webserver\webapps\main\WEB-INF\web.xml file and restart the web server but after I do this the Ignition website returns a 503 Service Unavailable error. I downloaded a thread dump using the Ignition Gateway Control Utility but I didn’t see any errors. Once I commented out this section and restarted the web service I was able to get back to the ignition log viewer and I was able to view the logs. I didn’t see any errors related to the web service configuration. ---
**Author:** ![c-w-t](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@c-w-t](https://forum.inductiveautomation.com/u/c-w-t)\ **Post date:** [December 20, 2018, 1:45pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/9 "2018-12-20T13:45:56Z")
Did you add the .jar file I mentioned? ---
**Author:** ![justin.sunseri](https://avatars.discourse-cdn.com/v4/letter/j/6a8cbe/32.png) [@justin.sunseri](https://forum.inductiveautomation.com/u/justin.sunseri)\ **Post date:** [December 21, 2018, 1:50am UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/10 "2018-12-21T01:50:21Z")
I figured it out yesterday. I looked at the directory and saw jetty-servlet and thought I already had the file necessary. One additional thing I had to do was to add ```auto chainPreflight false ``` to the filter so that it would work when the endpoint required authentication. ---
**Author:** ![PRAMANJ](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pramanj/32/66935_2.png) [@PRAMANJ](https://forum.inductiveautomation.com/u/PRAMANJ)\ **Post date:** [February 9, 2019, 5:59pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/11 "2019-02-09T17:59:07Z")
Could you please elaborate on what Kevin has suggested as the solution to the CORS issue? What exact code has to be put in the doGET and doPost methods of webdev postjson script? Then I will come to accessing with authentication. ---
**Author:** ![PRAMANJ](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pramanj/32/66935_2.png) [@PRAMANJ](https://forum.inductiveautomation.com/u/PRAMANJ)\ **Post date:** [February 11, 2019, 12:12pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/12 "2019-02-11T12:12:45Z")
Got it! It was firewall issue, that prevented the access. Its working now. However, I need to try the secure access! ---
**Author:** ![PRAMANJ](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pramanj/32/66935_2.png) [@PRAMANJ](https://forum.inductiveautomation.com/u/PRAMANJ)\ **Post date:** [February 11, 2019, 1:37pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/13 "2019-02-11T13:37:27Z")
However, I observe that when a remote client on another machine on network goes to hibernation mode , the connection times out and we have to restart the client window! Is there a way out? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [February 11, 2019, 1:44pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/14 "2019-02-11T13:44:49Z")
> [@prafull\_j](#): > > goes to hibernation mode Nope. Hibernation cuts off all TCP channels, per the TCP standard (timeout). Don't let the client hibernate (or sleep) if continuous connection is important. ---
**Author:** ![PRAMANJ](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pramanj/32/66935_2.png) [@PRAMANJ](https://forum.inductiveautomation.com/u/PRAMANJ)\ **Post date:** [February 11, 2019, 5:22pm UTC](https://forum.inductiveautomation.com/t/webdev-module-and-ajax/17073/15 "2019-02-11T17:22:58Z")
ok thanks, but Ignition server is amazing, it never fails, after wake-up is reestablishes all its connections.